How to create a secure authorization algorithm?

Question

PHP

Hello. I rummaged through a bunch of sites in search of an example of secure authorization in PHP, but did not find anything sensible (or the material is already outdated).
But still sketched some algorithm .. Connoisseurs, please tell me where his problem areas are and how to solve them.
So:

1. User login and password entry
   
2. Password hashing on the client side. Something like this: sha1(sha1(password, login) + randomKey). randomKey is generated randomly with each new authorization, in order to constantly send a different hash to the server (protection against interception).
   
3. We send the received hash and randomKey to the server
   
4. We check the hash of the client and and sha1 (hash_s_server + randomkey) on the server
   
5. If the authorization is successful, then we write down a session "key" in the cookie.
   

Further, let's say by key 123 ($_SESSION['123']) we will get the necessary data about the user (login, last login, etc.)
Actually, this is not a complicated algorithm. But the question is this: how to protect yourself from session hijacking (binding by IP saves exactly until the IP changes :().
And what are the more global problems of such an algorithm?

Answer 1

Can you implement something similar:
https://en.wikipedia.org/wiki/Salted_Challenge_Res...

Answer 2

Well, firstly, it is worth understanding what is the difference between authentication and authorization - from the outside, such a question looks rather ridiculous. Secondly, if https is considered an insecure environment, you can forward Diffie-Hellman keys and encrypt traffic with AES, but this is for complete paranoids, and you can also screw HMAC-SHA256 ... sha1 (sha1 (whatever)) from the point of view of cryptography full "pe". Usually it is customary to make backends stateless and store all information within the user session, salted and encrypted. And, directly, the passwords themselves in BCrypt / SCrypt etc.
Authentication in this case may look like this
: 1. Keys are exchanged
2. The person sends his login-password to the server via an encrypted channel
3. In response, it receives the user session object, which is stored in
cookies the need for session storage.
4. Optionally, CSRF tokens are generated within the user session.
5. Optionally, all traffic needs to be escaped, including all sorts of JSONP and so on. Angular generally from the box requires all JSONP to be prefixed with such a miracle ")]}',\n"