piwik/piwik — pull request #78 by squarewolf (2013-06-24 00:07:55+00:00)
Title: Added basic OAuth-like security layer allowing the private token to remain private

Additional security has been added by removing the private token from the actual request. To use the new authentication scheme, supply the following parameters:
* **nonce**: http://en.wikipedia.org/wiki/Cryptographic_nonce
* **timestamp**: the unix timestamp when the message was created
* **access_token**: the public access token matching the private token used to create the signature
* **signature**: a sha1 hash of the request parameters (excluding the signature) ordered as per http://oauth.net/core/1.0/#rfc.section.9.1.1, concatenated with the private key (in pseudo code: ```signature = sha1(order_params(params) + private_key))```)

**TODO:**
- [x] make private key private by excluding it from the actual request
- [ ] add nonce to the database to prevent replay attacks
- [ ] add timestamp timeout
- [ ] add two-tiered security scheme (i.e. unique public & private tokens per API client)