Tag Info

New answers tagged


Based on Justin's answer, I'm constructing my own. If the tokens are long enough (in my case they are 200 alphanumeric ([A-Za-z0-9]) characters, there is no need to salt them. Hashing alone should then be enough, since the complexity is high enough. If tokens are not long enough to get away with hashing only (or if you want to insist on salting them as ...


If requests from the third party to the OAuth provider have some other data that associates the request to the user, for example the user's name or id, the server could store the bearer token like a regular password with individual salts. However, if the third party requests don't have a piece of identifiable information, the server could store a ...

Top 50 recent answers are included