安全处理身份验证检查的最佳方法是使用REST / JSON / PHP / AJAX跨域

Question

I am using PHP/CodeIgniter and Tank_Auth library for authentication both on site.com and via the API, and a very basic REST API from Phil Sturgeon.

Right now when a user fills in username/password on Site1. It makes an API call like so:

http://site2.com/api/index/authenticate?username=jdoe&password=123456

On Site2.com: index/authenticate uses tank_auth library to compare username/password to what is stored in the database.

My Question: Is there a standard to encrypt the password during submission and then decrypt on the other side? Or would an SSL certificate be sufficient?

Answer 1

how about creating a hash of the 2 with some "salt", pass that in the query string, then make sure it matches by running the same hash on the 2nd server.

http://site2.com/api/index/authenticate?username=jdoe&password=123456&cs=fds34wsef3ewtdfgw54ty43wg    

make sure you keep the salt secret... not too sure about passing this in GET, especially passwords - maybe you could pass a separate id hash instead of the password. Definitely use POST though, and ideally SSL. The more you can obfuscate,encrypt the more secure this will be