Tell me more ×  I'm developing a server component that will
serve requests for a embedded client, which is also under my
control.  Right now everything is beta and the security works
like this:    1. client sends username / password over https.
2. server returns access token.    3. client makes further
requests over http with the access token in a custom header.
This is fine for a demo, but it has some problems that need to
be fixed before releasing it:    • Anyone can copy a login
request, re-send it and get an access token back. As some users
replied this is not an issue since it goes over https. My
mistake.    • Anyone can listen and get an access key just by
inspecting the request headers.  I can think of a symmetric key
encryption, with a timestamp so I can reject duplicate requests,
but I was wondering if there are some well known good practices
for this scenario (that seems a pretty common).  Thanks a lot
for the insight.  PS: I'm using Java for the server and the
client is coded in C++, just in ca