I need to quickly implement a RESTful authentication system for my JavaScript application to use. I think I understand how it should work, but I just want to double check. Here's what I'm thinking -- what do you guys think?Database schemausersid : integerfirst_name : varchar(50)last_name : varchar(50)password : varchar(32) (MD5 hashed)etc.user_authenticationsid : integeruser_id : integerauth_token : varchar(32) (AES encrypted, with keys outside database)access_token : varchar(32) (AES encrypted, with keys outside database)active : booleanStepsThe following happens over SSL. I'm using Sinatra for the API.JavaScript requests authentication via POST to /users/auth/token.The /users/auth/token API method generates an auth_token hash, creates a record in user_authentications, and returns auth_token.JavaScript hashes the user's password and then salts it with auth_token -- SHA(access_token + MD5(password))POST the user's username and hashed+salted password to /users/auth/authenticate.The /users/auth/authenticate API method will verify that SHA(AES.decrypt(access_token) + user.password) == what was received via POST.The /users/auth/authenticate will generate, AES encrypt, store, and return an access token if verification is successful; otherwise, it will return 401 Unauthorized.For any future requests against the API, JavaScript will include access_token, and the API will find the user account based on that.
Is this a secure solution for RESTful authentication?
rest;authentication