Working on a side-project writing an API and when it comes to authentication I am a little stuck. I am trying to decide what the differences between using Basic Auth vs $_POST fields for the actual login.
Once the login gets posted, I will return a token to the client that will then be used on subsequent API calls.
My plan looks like this:
- User enters username, password on client login form
- Client will hash the password
Client will send username and hashed password to API TokenController over SSL
TokenController will hash password again and verify credentials against the database
- If valid, returns a JWT and valid response to the client
If invalid, returns invalid response to client.
Client uses returned token to make other API calls like users/{id}
Only on the initial login will the credentials be sent in somewhat cleartext (they will be hashed). I think I could go with Basic Auth or sending as a normal POST and it would work fine.
Would either one work in this case?