I have an authentication service, a client and an application service.
The client needs to use the application, but they have to be authenticated first. I'm trying to create a simple scheme to do this and what I've come up with is:
The client contacts the authentication service, sends its metadata (e.g. license number)
The authentication service validates the client (i.e. checks the license against a database) and returns a token containing: some new metadata needed by the application, a timestamp telling when the token was created and a
HMAC-SHA256
for the mentioned data.The client uses this token to contact the application service and perform its tasks
The application service checks a client's token by validating the
HMAC-SHA256
(thus confirming that the token was generated by the authentication server) and also checks the timestamp, confirming that the token is still valid. If the operations succeed, it will use the metadata from the token to perform the task required by the client.
All communications between the authentication service and the client, as well as between the client and the application service are done over HTTPS. The secret key shared between the authentication service and the application service will be something large (e.g. at least 64 bytes)
My question is if anyone sees any flaw in this scheme.
PS: I know OAuth 1/2 exist, but to be honest I'm horrified to look into those. What I need is something really simple, like that "JWT stateless session" everyone recommends against. Oh, and I don't want to use JWT or Paseto because I've done a benchmark and a simple HMAC is faster (than Paseto at least)