###What is token based authentication

Token-based authentication is a method to authenticate user access to the specific resources with a valid token that is generated by the server only if user provided a correct username and password.

###Steps to implement a simple token-based authentication example

a)    Create customer database
b)    Unique token generator
c)    Implements customer login operation
d)    Authentication

###Create a customer database

Create table customer  (
  customer_id int(11) not null AUTO_INCREMENT,
  username varchar(255) unique not null,
  password varchar(255) not null,
  token varchar(255),
  expired varchar(100),
  ip varchar(255),
  primary key (customer_id)
);

Add a customer:

Insert into customer(username, password) values("admin", "123456");

###Unique token generator

We need a method to generate unique token for different customers. The token is composed by three parts: machine id, timestamp and unique id.

//generate token
function generate_token(){
  $date = new DateTime();
  $token = $date->getTimestamp();
  //if we have multiple server, we need to assign different prefix to each one
  $token = uniqid('server1', true);       
 return $token;
}

###Customer login

<?php
  error_reporting(E_ALL);
  ini_set('display_errors', 1);

  //get username and password
  $username = $_POST['username'];
  $password = $_POST['password'];
  $ip = $_SERVER['REMOTE_ADDR'];

 //generate token
function generate_token(){
  $date = new DateTime();
  $token = $date->getTimestamp();
  $token = $token . uniqid('server1', true);       //if we have multiple server, we need to assign different prefix to each one
  return $token;
}

//connect database
try {
  $pdo = new PDO('mysql:host=localhost;dbname=project1', "project1", "0WkWy2dIHhcLfLKs");

  $sql = "select * from customer where username=:username and password=:password";
  $sth = $pdo->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
  $sth->execute(array(':username' => $username, ':password' => $password));
  $customer = $sth->fetchAll();

  if(count($customer) == 0){

    echo "username or password not correct";
    die();

  }else{

    $customer = $customer[0];
    $customer_id = $customer['customer_id'];
    $token = generate_token();

    //expired after 24 hours
    $date = new DateTime();
    $date->add(new DateInterval('PT24H'));

    $sql = "update customer set token=:token, ip=:ip, expired=:expired where customer_id=:customer_id";
    $sth = $pdo->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
    $sth->execute(
        array(
            ':token' => $token,
            ':ip' => $ip,
            ':expired' => $date->getTimestamp(),
            ':customer_id' => $customer_id
        )
    );

    echo "token : " . $token;
  }

  $dbh = null;
  } catch (PDOException $e) {
    print "Error!: " . $e->getMessage() . "<br/>";
    die();
}

###Authentication by token

<?php
  //check user token
  $token = $_POST['token'];
  $ip = $_SERVER['REMOTE_ADDR'];

 //current timestamp
 $date = new DateTime();
 $timestamp = $date->getTimestamp();

 //connect database
 try {
   $pdo = new PDO('mysql:host=localhost;dbname=project1', "project1", "0WkWy2dIHhcLfLKs");

   $sql = "select * from customer where token=:token and ip=:ip and expired > :timestamp";
   $sth = $pdo->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
   $sth->execute(array(':token' => $token, ':ip' => $ip, ':timestamp' => $timestamp));
   $customer = $sth->fetchAll();

   if(count($customer) == 0){

     echo "you haven't login system";
     die();

   } else {

     $customer = $customer[0];
     $username = $customer['username'];

     echo "you are : " . $username;
  }

} catch (PDOException $e) {
  print "Error!: " . $e->getMessage() . "<br/>";
  die();
}

By checking IP address and expired time, an illegal token can be prevented to access the system.