Timeline for Translate token into cookie
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 27, 2016 at 16:57 | history | tweeted | twitter.com/StackSecurity/status/736239926514221057 | ||
| May 26, 2016 at 12:10 | comment | added | Ilya Chernomordik | You are welcome. If you have enough entropy and very short-lived tokens, that should be quite safe. Don't forget to use Secure PRNG to generate the tokens and you'll also need to make sure they are URL-friendly. | |
| May 26, 2016 at 12:05 | comment | added | Daniel Revell | @IlyaChernomordik good point. i only realised this when i tried to do it. i'm not going to pass the full bearer token to be safe, and generate a single use code for a given transfer. a little more complex but worth it for safety i feel. thanks for the help | |
| May 26, 2016 at 11:09 | comment | added | Ilya Chernomordik | @DanRevell, I am not sure if it's possible to achieve, since it's only a url opened from an app to a browser. So perhaps one ordinary http get with URL is all you can do. | |
| May 26, 2016 at 8:44 | comment | added | Daniel Revell | @IlyaChernomordik thats a great point, but now you mention it, I don't see why the token can't be in the body. i control both the client and server so i can just say the client has to post to the entry point. this way the token is a little more secure as compared to the url. | |
| May 25, 2016 at 20:30 | answer | added | Ilya Chernomordik | timeline score: 1 | |
| May 25, 2016 at 20:25 | comment | added | Ilya Chernomordik | @LittleCode How is that a backdoor? Seems like a perfectly valid scenario. The token has to be passed in ANY case, so it's just passed in the URL this time (not in a body of a POST e.g.). So there are some problems with it being sent to URL, but if the token is short lived, should be OK. | |
| May 25, 2016 at 10:46 | comment | added | Daniel Revell | @LittleCode Thats for the feedback. I expressed myself that I was uncomfortable with the approach but it might well be the right one. It's not exactly a backdoor, more a non-standard second front door. The reason I put this post here was to create a discussion on pitfalls of the approach and hopefully hear someone suggest a possible alternative. | |
| May 25, 2016 at 10:24 | comment | added | Little Code | "So my thinking is add an entry point route to MVC, that doesn't require auth and takes as parameters the token used on the api" ..... so "your thinking" is you want to create a backdoor. Good luck with keeping that secure ! | |
| May 25, 2016 at 8:04 | review | First posts | |||
| May 25, 2016 at 8:07 | |||||
| May 25, 2016 at 8:01 | history | asked | Daniel Revell | CC BY-SA 3.0 |