How to sign and secure request data?

Question

PHP

The task is to protect a request of the form from:
1. Iteration of $ORDERID
2. Visibility of $ORDERID
3. Knowing that the request came from where it was created, and not "manually"
/payment/$ORDERID/
/payment/$USERID/
At first there was an idea : /payment/$ORDERID/$SIGN, where
$SIGN = hash( 'sha256', $orderID . $this->salt)
But I think this is not enough. I would like not to shine $ORDERID and $USERID
Does it make sense to use:

$nonceSize = openssl_cipher_iv_length($METHOD);
        $nonce = openssl_random_pseudo_bytes($nonceSize);

        $ciphertext = openssl_encrypt(
            $message,
            $METHOD,
            $key,
            OPENSSL_RAW_DATA,
            $nonce
        );

        return base64_encode($nonce.$ciphertext);

To get a simple request without a signature: /payment/$CRYPTEDDATA
$CRYPTEDDATA = crypt($ORDERID);
Or do I need to add a hash? Or is encryption enough? I do not want to complicate to the level of delirium.

Answer 1

I do not want to complicate to the level of delirium.
Unfortunately, you will have to write some wrapper to encrypt/decrypt the protected segments. If you can make it so that the code is flexible and reusable, then it won't be bullshit.
In particular, you can change the encryption algorithm to one that is less expensive in terms of CPU time.
I would opt out of return base64_encode($nonce.$ciphertext); in favor of translating each byte of the ciphertext into hex (for example), or even into some 25-decimal system (English alphabet).

Answer 2

https://tech.yandex.ru/money/doc/dg/reference/noti...
it's not very clear what you want, but it seems like a scheme like Yandex-money will do

Answer 3

You can use aes 256 encryption with a secret. from selection protection and data userId and orderId are not visible.