title: Securing a PHP Server from a Hijacker
body: <p><strong>BACKGROUND:</strong> I'm implementing a PHP Server without HTTPS/SSL.  On it, I want to authenticate that the user making calls to server is valid assuming that the communication between the app and the server is being watched by a hijacker (hacker with a network sniffer).  I further assume that the hijacker is an app owner trying to figure out how the app communicates with the server in order to hack my system.  I will have no control on who is an app owner.</p>
  
  <p>What I have implemented so far is that the app needs to start a session before they can any work against the server.  To do this the app first sends a request to the server with a randomly generated code, and an authorization number, and the server responds with a security token.  The authorization number is based on the code and some other secret information in the app.  On subsequent calls the app regenerates the code and uses the token plus other secret information recalculate an authorization number (it never retransmits the token to the server either).  This is how each call is validated.</p>
  
  <p>It's set up so that the calling parameters of one call cannot be reused the next time, so that if a hijacker can see the message used within a session, they cannot do anything with it.  Using them simply indicates that the call is "not authorized".  I'm 99% sure I've plugged all the related holes to the session communication, such that the hijacker cannot invade my environment.</p>
  
  <p><strong>PROBLEM:</strong> The hijacker will see the original session request, reuse those parameters to get a new session and use them to eventually figure out how the session calls the work.  </p>
  
  <p><strong>QUESTION:</strong> What strategy would you employ to validate that it is only my app talking to the server during the initial session request and not a hijacker impersonating my app in order to start a session?  </p>
  
  <p>Note: Saving the session start parameters is unrealistic.  One idea I have is to embed the "GMT time + N seconds" into the randomly generated code then test to see if the server's GMT &lt; app's GMT+N; this way the randomly generated code become invalid within N seconds.</p>