title: PHP Rest api security
body: <p>We are currently working on a game in java.
  For the user authentication we are using a rest api I made in PHP.</p>
  
  <p>I'm using sessions to store the UID and the game stores the session in a <a href="http://download.java.net/jdk8/docs/api/java/net/CookieStore.html" rel="nofollow">CookieStore</a>.
  We've come to the conclusion that this isn't secure enough. We thought about a temporary token, but the 'attackers' will somehow be able to get tokens himself. We could also use an api secret key, but attackers might be able to reverse-engineer the game.</p>
  
  <p>What we want is that nobody can access the api except our game.</p>