RESTful Authentication - Questions about the Process

Question

I find web security to be a very interesting subject and I am trying to learn how to make API's and RESTful Web Services. I was reading this answer and just has some questions to the process described in Way-2. I understand the gist of Way-2, but I start having questions at Step 4.

First let's describe the token variable.

$token = '123';
$tokenHashed = 'abc';
$tokenEncrypted = 'xyz';

At Step 4 we have verified the user, and now it is time to create a token and associate it with that user in the database as well as send it to the client. Here are questions I have about that process:

1. The token we store in the database, is it "hashed(abc)", "encrypted(xyz)", or "neither(123)"?
2. When we send it to the client, do we sent it "hashed(abc)", "encrypted(xyz)", or "neither(123)"?
3. Where is this token stored on a client machine? I am using PHP so would it be in a $['SESSION'] or $['COOKIE'] variable? Does it matter? Which one and why?

I think that covers everything under Step 4, so let's move on the Step 5. One thing that concerns me about Step 5 is that it says, "The caller then sends this auth token..." I've read that you NEVER transmit the token, so here come some more questions (assume the client has the token stored in whatever fashion answer 2 above states):

1. Does the client send the token "hashed(abc)", "encrypted(xyz)", or "neither(123)"?

   If they are just sending it back how we sent it to them, then what is the point? If someone hijacks the token in whatever form we sent it, won't it always match how we stored it? For example, I send USER X a random hashed string(abc). USER Y intercepts it and sends me (abc). My DB says 'abc', security fail.

I will probably keep developing/adding questions as answers come in. Thank you for your help!

Answer 1

The JWT is a kind of solution, REST API's are meant to be stateless. What that means is that each request from a client should include all the information needed to process the request,so the php session is out of place. You can read this,Goodbye PHP Sessions, Hello JSON Web Tokens

You do not need to save the JWT Token in your database, you just need to generate a token with a secrete key at the server side and send to the client, and client should send the token at each request.

The Browser can save the token in html5 localStorage, or maybe cookie.

The server resolve the encrypted token with the secrete key, then get the information from the token.

Maybe You can keep some message in JWT token like:

1. expire time.
2. client ip.
3. type.
4. ... custom message.