title: REST api authenication with laravel
body: <p>I am building a RESTful api with laravel using the RESTful controller property. So far i've been able to get most of it working. The issue am having now is authenication, am trying to use Amazon approach using a "user_id" and "signature".
  Am creating the signature using php's 'hash_hmac()'.</p>
  
  <p>this an example api controller</p>
  
  <pre><code>class Api_Tasks_Controller extends Api_Controller {
  
      public $restful = true;
  
      public function get_index($id = null) {
  
          $this-&gt;verfiy_request();
  
          if(!is_null($id))
          {
              return Response::json(array("tasks"=&gt;"just one"),200);
          }
          else
          {
              return Response::json(array("tasks"=&gt;"everthing"),200);
          }
      }
  
  
  }
  </code></pre>
  
  <p>and this the api controller class</p>
  
  <pre><code>class Api_Controller extends Controller {
  
      public function verify_request() {
  
          //user id
          $user_id = (int) Input::get('user_id');
          //signature
          $sig = Input::get('sig');
  
          //Lookup user
          $user = Sentry::user($user_id);
          if($user) {
              //user email
              $email = $user-&gt;email;
              //user api key
              $api_key = $user-&gt;metadata['api_key'];
              //recreate signature
              $_sig = hash_hmac("sha256",$email.$user_id,$api_key);
              if($_sig === $sig) {
                  return Response::json(array("message"=&gt;"Request Ok"),200);
              }
              else {
                  return Response::json(array("message"=&gt;"Request Bad"),400);
              }
          }
          else {
  
              return Response::json(array("message"=&gt;"Request not authorized"),401);
          }
      }
  </code></pre>
  
  <p>Making a get request <code>http://api.xyz.com/v1/tasks/1?user_id=1&amp;sig=41295da38eadfa56189b041a022c6ae0fdcbcd5e65c83f0e9aa0e6fbae666cd8</code> always returns a successful message even when i alter the value of the user_id parameter which should void the signature an make the request invalid.
  It seems my <code>verfiy_request</code> method is not executing.
  Please help me out</p>