如何使用用户凭据为移动应用和后端服务器通信签署HTTP请求？

Question

We have a pretty standard scenario - a mobile app communication with a backend PHP server API via HTTP POST and GET. A user must login in mobile app in order to do anything, so every request from mobile app to our server needs to be signed with user credentials. Userid and password are saved in mobile app internal settings after successful login, so a user does not need to reenter it again.

Previously, backend PHP webservices were developed by other guys, but now we need to implement it ourselves. When looking at previous projects, they required to pass user credentials for every request. I'm posting several request examples below. All data insert/update web services use POST, but userid and pwd are passed inside body with other data (Save Car). All data select services pass userid and its password via GET params.

Is it the best and secure way? Maybe we should put sha1(userid+password=salt) into HTTP authorization header and leave userid in body (because we need to select user pass from database in server)? Or maybe we could use OAuth 2 in mobile app for signing HTTP request (generating userid+pass+... to authorization header) and use OAuth 2 in backend to generate the same hash and check if it's the same? I could'n find any straightforward way how to use OAuth 2 for PHP just for signing request, so any help would be appreciated :) Also, related info about what libraries to use for iOS/Android development would be also appreciated.

LOGIN

HTTP method: POST
URL: http://mybackend.com/login
BODY:

 { "uid" : 123,
   "pwd" : "3CB3E2E6AECA48C41000119767B561F5E9E66229" // contains sha1(pass+salt)
 }

GET CAR LIST

HTTP method: GET
URL: http://mybackend.com/getCars?uid=123&pwd=3CB3E2E6AECA48C41000119767B561F5E9E66229

SAVE CAR

HTTP method: POST
URL: http://mybackend.com/saveCar
BODY:

  { "uid" : 123,
    "pwd" : "3CB3E2E6AECA48C41000119767B561F5E9E66229",
    "car" : 
    { "id" : 111,
      "name": "My car"
    }
 }

Answer 1

I may ask if user can change password in app then is it updating that password with the saved one in app code?

better way to post data as make a directory of access_token and use userid and password in it. as for Example : { "access_token":{ "uid" : 123, "pwd" : "3CB3E2E6AECA48C41000119767B561F5E9E66229" }, "saveCar" : { "id" : 111, "name": "My car" } }

and at the sever side php code be easy to access your all url with this accesstoken by checking with database and allowing you access to do the saveCar in database. else from sever side you will have error message as access failed to login try again with login. and use it in post method with all requests. will be good for security type. POST method is one for PHP data security. no other thing you need for this.

Instead of using GET HTTP request for car list, you can POST the access token to your url as

{ "access_token":{ "uid" : 123, "pwd" : "3CB3E2E6AECA48C41000119767B561F5E9E66229", } } to your URL for Carlist. http://mybackend.com/getCars? from that post method, do the code for as in result of this post method returns the list of cars.

Thanks, Hope this description can help you.