title: How do you create a PHP login web service that can be used from multiple applications?
body: <p>I have written the following authentication web service using php:</p>
  
  <p><strong>authenticate.php</strong></p>
  
  <pre><code>&lt;?php      
    require('_includes.php');
    $username = fetchPostParam('username');
    $password = fetchPostParam('password');
  
    // A higher "cost" is more secure but consumes more processing power
    $cost = 10;
  
    $salt = strtr(base64_encode(mcrypt_create_iv(16, MCRYPT_DEV_URANDOM)), '+', '.');
  
    // this is so php can recognize / verify this later. "$2a$" Means we're using the Blowfish algorithm. The following two digits are the cost parameter.
    $salt = sprintf("$2a$%02d$", $cost) . $salt;
    $hash = crypt($password, $salt);
  
    //grab the username/password from the database
    $mysqli = getMysqlConnection();
    if (mysqli_connect_errno()) {printf("Connect failed: %s\n", mysqli_connect_error());exit();}
    $query = "SELECT * FROM usercreds where username = '{$username}'";
    if ($result = $mysqli-&gt;query($query)) {
        while ($row = $result-&gt;fetch_assoc()) {
          $dbusername = $row["username"];
          $dbhash = $row["hash"];
        }
        $result-&gt;close();
    }
    $mysqli-&gt;close();
    if($username == $dbusername &amp;&amp; password_verify($password, $dbhash))
    {
      // ????????????????????
    }
    else
    {
      // ????????????????????
    }
  ?&gt;
  </code></pre>
  
  <p>I have multiple applications that users will be able to use to log into their account, so I'm trying to get this web service to be sort of "universal" for my family of applications.  Everything in this PHP service is working fine.  You send in a users credentials to the correct url via HTTPS POST, it authenticates them, and then properly routes into the if-else at the end depending on whether or not the authentication succeeded.</p>
  
  <p>Where I'm getting tripped up is what I need to do on the other end of this web service.  For example, say I have this login form from my simple electron/node.js application:</p>
  
  <pre><code>&lt;form id="loginform" method="POST" action="https://localhost:8888/webservices/authenticate.php"&gt;
    &lt;input type="text" name="username" id="username_field" placeholder="Username"/&gt;&lt;br /&gt;
    &lt;input type="password" name="password" id="password_field" placeholder="Password"/&gt;&lt;br /&gt;
  
    &lt;button type="submit" id="login_button"&gt;Let's do this!&lt;/button&gt;&lt;br /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>You can see this form's action is the authenticate.php from earlier, and we're using the POST method.  However (as expected), when the user submits their username/password, the page physically routes over to the authenticate.php, which isn't a good thing if we're going to be hitting this web service from many different applications.</p>
  
  <p>I also tried dabbling in using an ajax call via jQuery.  However, there is an obvious downside to this which is that even a slightly savvy programmer can see plaintext passwords if they set the right breakpoints in the javascript.</p>
  
  <p>My ideal case would be to throw the username and password onto the other side of the fence, and then the webservice will toss back a true or false, along with some other info, to the application.  This way, the web service handles authentication, and the application handles what needs to be done based on a success / failure.  And obviously I'm trying to make this secure from start to finish.</p>
  
  <p>How do I achieve this sort of login/authentication process given what I have laid out?</p>