title: PHP: Secure a Rest Service with a Token mixed with Timestamp
body: <p>I have a rest service that my website calls it and I want to secure it from calling outside of my website as much as possible.</p>
  
  <p>I want to create a token mixed with timestamp, so the user can only call the service in 10 minutes (for example) with the token that generated in the server.</p>
  
  <p>Let me explain it with some pseudo codes:</p>
  
  <p><strong>1) Server:</strong> The token is generated in the server using a private key and timestamp:</p>
  
  <pre><code>// The token is valid only for 10 minutes after 'time'
  $token = encrypt($pKey, timestamp); // Server Time
  </code></pre>
  
  <p><strong>2) Client:</strong> We put the token in the javascript variable and use it in our request with the timestamp of the client:</p>
  
  <pre><code>var token = '&lt;?= $token ?&gt;';
  var params = {
    token : token,
    time  : timestamp, // Client Time
    data  : mydata
  }
  </code></pre>
  
  <p><strong>3) Server:</strong> If the time parameter mixed with token is not equal to 10 minutes token, the request is invalid:</p>
  
  <pre><code>// I'm Stuck Here
  $something = decrypt($pKey, $_POST['token'], $_POST['time']);
  if ($something != $tenMinutes) { // Invalid Request }
  </code></pre>
  
  <p><strong>The Question:</strong></p>
  
  <p><strong>1)</strong> Is this senario O.K? If Yes, What is the exact solution? If No, So What is the solution?</p>
  
  <p><strong>2)</strong> There is another senario to secure the requests that I've seen in the AWS: <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/S3_Authentication2.html" rel="nofollow">http://docs.aws.amazon.com/AmazonS3/latest/dev/S3_Authentication2.html</a>
  <br/>How can I implement this in PHP?</p>