title: PHP / JS Login System
body: <p>so I have a self written php web service for an app.</p>
  
  <p>Now I want to do the same with the web. But I struggle with the login.</p>
  
  <p>I need to call 2 functions of the web service. One to get a login token another one to verify that and request a access token.</p>
  
  <p>So I call them with javascript:</p>
  
  <pre><code>    &lt;?php
          if(isset($_POST['email']) &amp;&amp; isset($_POST['password']))
          {
  ?&gt;
              &lt;script&gt;
                  var xhttp = new XMLHttpRequest();
                  xhttp.open("POST", "http://webservice.com/requestLoginToken", false);
                  xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
                  xhttp.send(&lt;?php echo "'email=" . urlencode($_POST['email']) . "'"?&gt;);
                  if(xhttp.status == 401)
                      document.getElementById("message").innerHTML = xhttp.responseText;
                  else 
                  {
                      var loginToken = xhttp.responseText;
                      var pwHash = loginToken + &lt;?php echo "'" . sha1($_POST['password']) . "'" ?&gt;;
                      pwHash = sha1(pwHash);
                      xhttp = new XMLHttpRequest();
                      xhttp.open("POST", "http://webservice.com/authenticate", false);
                      xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
                      xhttp.send("loginToken=" + loginToken + "&amp;publicHash=" + pwHash);
                      if(!xhttp.status == 200)
                          document.getElementById("message").innerHTML = xhttp.responseText;
                      else 
                      {
                         var accesstoken = xhttp.responseText;
                      }
                  }
              &lt;/script&gt;
      &lt;?php
          }
      ?&gt;
  </code></pre>
  
  <p>So now I have the access token. But how can I set this now as a session variable of $_SESSION? </p>
  
  <p>Or what is the best way so save this access token during the stay?</p>
  
  <p>I need this token whenever I call the API.</p>