2

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation here:

When using hashed API tokens, you should not generate your API tokens during user registration.

The questions are:

  1. When should the token being generated if it's not during registration?
  2. Is the token supposed to be generated on every login with specified expiration time?

Thank you!

Improve this question
3
  • In the documentation that you mentioned, the recommendation is to use Laravel Passport, "which provides a full OAuth2 server implementation for your Laravel application". Have you checked this already?
    – Filipe dos Santos
    Commented Feb 3, 2020 at 16:37
  • The Laravel Passport documentation explains when and how an API token is generated, and that it's default lifetime is 1 year.
    – Filipe dos Santos
    Commented Feb 3, 2020 at 16:39
  • As you said, Laravel Passport uses OAuth 2.0 which is the best for inter-application Authentication (and Authorization, I think...) but in this case, the API server only serve one mobile app (which supports Android and iOS). That's the reason why I prefer more simple approach but keep it secure.
    – Thor-x86_128
    Commented Feb 3, 2020 at 16:51

1 Answer 1

Reset to default
0

laravel use php concepts and libraries.

so if we install any jwt libraries we can find out all of them use a configuration file for set expire date for jwt tokens ( for example 7 days. ) see this article

you as developer can configure it e.g 30 s. https://stackoverflow.com/a/41268134/308578

if you watch this video i definitely sure ,you can found out more about jwt token libraries functionality and their concepts . but this video about nodejs but concept is the same ....

any time to want you can refresh or generate tokens and pass it to your clients.

i think after this video you can understand more all you want

enjoy

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .