title: Implementing simple authentication for PHP REST API
body: <p>I am working on adding a REST API to a legacy PHP site. This is to provide an endpoint for an internal app, so I am quite free in how I design things and what do and don't support.</p>
  
  <p>What I now need to add to this API is a way to login, and then perform actions as a specific user. The site has been built years ago and not necessarily with the best practices at the time, so I am unfortunately a bit restricted in how I do this. All of this needs to run in PHP 5.4 with MySQL 5.6.</p>
  
  <p>I have been reading up on common designs for this and OAuth1/2 looks like the most common standard. However, this seems like massive overkill for my purposes, since it has various features that I do not need and seems very complicated to implement.</p>
  
  <p>Instead, I am planning on just doing something like this:</p>
  
  <ul>
  <li>The client calls a <code>get_session</code> API endpoint, which generates a random session ID, saves that to a table in the database and returns it to the client.</li>
  <li>The client saves this session ID.</li>
  <li>Then the client authenticates by sending a request to the <code>login</code> endpoint, sending the username, password and session ID (via HTTPS obviously).</li>
  <li>The server compares the data to the user table and, if the login is correct, updates the session table to associate the session ID with the corresponding user ID. This needs to be rate-limited in some way to prevent brute forcing.</li>
  <li>Now the client can call any other endpoints providing only its session ID for authorization.</li>
  <li>On each request, the server looks up the session ID, sees which user it has been associated with and performs the correct action.</li>
  <li>The client can remember the session ID for future use, until it either gets removed manually or expires after some amount of time.</li>
  <li>To log out, the client sends a request to the <code>logout</code> endpoint and the server removes the association with the user account.</li>
  </ul>
  
  <p>Is this a reasonable design? It's obviously not very sophisticated, but I am looking for something that I can implement without a huge hassle or requiring third-party libraries.</p>