Authentication with HMAC SHA256 (or MD5) hash

Is your feature request related to a problem? Please describe. I want a shortcut to make some very personal stuff, so it has to be guaranteed secure. The only way I see how to implement it is to use HMAC SHA256 (or MD5) hash based authentication procedure, like most of crypto-exchanges do. The goal is to have a at least one secret key which is never-ever-ever sent but affects any outgoing request. So it will make requests invulnerable to attack MITM.

Describe the solution you’d like Example implementation:

1. user provides a pair of keys, f.e. { api_key, passphrase }
2. API-KEY header is set with api_key value
3. API-EXPIRES header is set on request, f.e. 10 seconds from now in some format. request would be rejected if it will be processed after that time.
4. API-SIGNATURE header is set with kinda hex(HMAC(passphrase).SHA256(api_key + expires + request.method + request.path + data))

Describe alternatives you’ve considered The alternative solution is to add MD5 and/or SHA256 hashing methods to the scripting engine.

Additional context HMAC on Wikipedia Detailed description of this method

[Waboodoo]

In the upcoming version 2.3.0, I’m adding the hmac function, which can be used to compute the HMAC of a given message through scripting, e.g. hmac('sha-256', 'my-key', 'my message')

[bellerofonte]

That is awesome! Thank you!