App backend user sign-in API

The app sends the username and password to the server, and the server verifies that the user name and password are correct, generating a token string in the Redis or memcached server with the user ID key. The server then returns both the token string and the user ID to the client (the client generates the signature via token), such as the token string "DAF32DA456HFDH" and the User ID "5".

Assuming the API request is "Test.com/user/info", after generating the MD5 signature through the token string "DAF32DA456HFDH": MD5 ("test.com/user/info&token= DAF32DA456HFDH ") = c99dc0c22437ac275c08ce4a9708b25a, and the API request is followed by a signature and a user id: test.com/user/info?userid=5&sign= c99dc0c22437ac275c08ce4a9708b25a

After the server receives this URL, use the UserID to obtain tokens, and then use the same algorithm to generate the signature and the sign parameter comparison, if the equivalent, it means that the URL is valid, then continue to execute the API call, using the above method, you can avoid token in the API call disclosure

The above approach also has a problem because the API request "test.com/user/info?userid=5& sign=c99dc0c22437ac275c08ce4a9708b25a" does not have an expiration time, Assuming that someone else gets the request for this API, it can be called repeatedly. The improved method is to increase the timestamp in the passed parameter, and when the time stamp is found to be long, the URL has been invalidated.
But how do you keep your app's time and server time in sync with timestamps? In the app each time it starts and the server syncs, and then the app built a clock, timestamp in the app's internal clock gets, prevent users to modify the phone time caused by inconsistent time.

The following improvements have been made:

Assuming the API request is "Test.com/user/info", after generating the MD5 signature with the token string "DAF32DA456HFDH" and the Timestamp: MD5 ("test.com/user/info?userid=5&token= daf32da456hfdh&timestamp=1425860757 ") = c116161a6f430343b6cecf08562f1371, then the API request is signed and the user ID is" test.com/user/ Info?userid=5&timestamp=1425860757&sign= c116161a6f430343b6cecf08562f1371 ", the server receives this API request, If you find that the URL request has been received for a long time and time=1425860757, it is determined that the URL was intercepted by someone else and repeatedly called. If time is legal, then use the algorithm above to determine whether the sign is consistent, if others modify the URL on the timestamp is not afraid, because the signature and the server side of the signature is not equal

App backend user sign-in API