Consider using a secret salt known only to the client and server installed at login (I hope you are logging in to SSL). Subsequently, the server can provide an account with each response, and the client can provide a hash (account + secret salt) with the following request. A potential hijacker does not have access to the secret salt and cannot generate the next hash. Even non-SSL login can probably set a secret salt if login is performed using one-time hashed passwords.
davej source
share