title: RESTful API Auth flow
body: <p>I've been on stack overflow for the last hour researching this topic so I thought I'd just ask all my specific questions. I'm building a web app currently using Laravel (PHP) for the API and Angular for the front. I've looked at oAuth but it's a little daunting atm so I was hoping to implement a simpler solution and then rebuild it in when necessary.</p>
  
  <p>The flow I'm currently implements goes as follows. Angular posts the user credentials (over https) to my rest backend and this simply returns a generated string (this will probably be random or crytographicaly generated). This string is then stored as a cookie or whatever browser state I find suitable and then attached to every API request along with a user id that angular makes as an extra parameter or request header or something. The API uses this to check if the user has access to the requested resource and responds accordingly. I'd probably also add a expiry time on the string which would be reset after every request.</p>
  
  <p>My question is really if this is an acceptable flow? In terms of security what issues am I most likely to face with this? CSRF? Session fixation?</p>
  
  <p>I know this is a question that's been asked a couple times before but I was just hoping for a fresh discussion and be pointed towards relevant information.</p>