title: How to decrypt original password after hash token expires
body: <p>I'm building a REST API in PHP and I'm currently working on the security side of things.</p>
  
  <p>I have read a lot about network authentication and implemented some suggested strategies.</p>
  
  <p>I'll explain what I've done so far and where I got stuck.</p>
  
  <p>To prevent a hacker from knowing all users' passwords if they got their hands on my database, I keep only a hashed version of the passwords in db. I use the php password_hash() function that creates a salt automatically. Also, the hashed password expires 30 minutes after logging in with the original password.</p>
  
  <p>To prevent sniffers from seeing the hashed password in request headers, the client sends several headers in every request: a timestamp, some random string and a hashed checksum of the combination of hash+timestamp+random_string+url.</p>
  
  <p>Now, my question is what happens when the hash token expires (after 30 minutes)? The user now needs to send their original password to get a new token, but the server only keeps a hash of the original password. Using the checksum method wouldn't work because the server needs the original password to get the right result for hash comparison. So it has no way of knowing the user password is correct.</p>
  
  <p>P.S. I'm not worried about replay attacks at the moment, but if I were to implement security against this kind of attack, would I have to keep a history of all Nonce strings at the client side and all cNonce strings at the server side?</p>
  
  <p>Thank you.</p>
  
  <p>EDIT:</p>
  
  <p>The documentation states that password_hash() uses bcrypt algorithm which handles the creation of a salt automatically.
  As for the checksum string, I hash it using the SHA256 algorithm.</p>