title: HTTP Authorization Header - Bearer token security
body: <p>I'm building an API which will be consumed from both web and mobile platforms.</p>
  
  <p>I would like some help and pieces of advice to <code>improve my bearer token authorization</code>.</p>
  
  <h3>Authentication</h3>
  
  <p>The current authentication is pretty simple. I will presume that the sent credentials are correct:</p>
  
  <ul>
  <li>Sending Email and password to API endpoint</li>
  <li>Storing user token with expiration date</li>
  <li>Replying client with user authorization token</li>
  </ul>
  
  <h3>Authorization</h3>
  
  <p>Then, any other action authorization consists in:</p>
  
  <ul>
  <li>Sending Authorization Bearer "token" header</li>
  <li>Deciding if the token owner is allowed to do the action</li>
  <li>Completing the operation</li>
  </ul>
  
  <h3>Concern</h3>
  
  <p>My concern is that <strong>if anyone just review the request headers, the bearer token could easily be discovered</strong>. That would allow the user to do any harmful request from any rest client.</p>
  
  <p>Most of the requests that could be done intentionally bad, are completely valid from the application context. So, it wouldn't be easy to filter them out by request parameters.</p>
  
  <h3>Possible fix</h3>
  
  <p>I've been thinking about the possibility to <strong>send on headers</strong> :</p>
  
  <ul>
  <li>User authorization token</li>
  <li>Sent date or any other parameter</li>
  <li>Hash (token, other parameter)</li>
  </ul>
  
  <p>On server, I would compare each parameter individually and then the encrypted hash.</p>
  
  <p>So, if someone is sending the same hash with a different date, it could easily be detected as an intruder.</p>
  
  <hr>
  
  <p>Do you have any other suggestion to make the communication more secure?</p>