title: Security for a REST based API
body: <p>I have been looking at techniques to secure an API for use in an android/iphone app or website application.<br/>
  I have found one technique which I like but am unsure about if it is a good or what is wrong with it (aside from being a pritty long process).<br/></p>
  
  <p><b>Processing (users side initially):</b><br/>
  First a salt is created by hashing the users password.<br/>
  Then a signature is created by hashing the requested url (with username appended on the end via a query string) and the salt.<br/>
  Lastly a token is created by hashing the username and the signature.<br/>
  The token is passed inside a header to the server (everytime).</p>
  
  <p><b>First Request:</b><br/>
  The first request must be for the validate endpoint and include the device_id as a query string.<br/>
  The same processing (as above) is done on the server and if the token matches that sent from the user than the device_id is stored in the database and is assigned to that username for future reference (the device id is found in the requested url) and is used to verify the username/device thereafter.</p>
  
  <p><b>All subsequent requests:</b><br/>
  The processing must take place on the users end and servers end for every request now with the token being different everytime (as the requested url changes).<br/>
  No code is included as it is not written yet.</p>