4

What's the best way to share my access tokens? Is it okay to share it in the header as plain-text, or do I need to look into e.g. JWT?

Current workflow:

-> POST /api/login -d {**creds}
<- 201 [headers (including X-Access-Token)]
-> GET /api/secrets -H 'X-Access-Token: ""'

The header currently consists of:

X-Access-Token: <scope>::<uuid>::<expires_in>::<state>
  • 2
    Is your connection TLS, or plain HTTP? What is your concern? – wei Dec 9 '15 at 0:01
  • If you are providing a service then the best way to provide it is in the way that clients can use it (i.e. why not both) – symcbean Dec 9 '15 at 0:17
1

If you are doing this for federated identity (single machine/human using multiple services) then use a purpose-built system for that.

Federated identity is hard to build correctly and unlikely to be important enough to your business to be a core competency that you'll justify maintaining properly.

I recommend using SAML 2.0 because it is broadly deployed and supported. Many implementations (including Shibboleth/OpenSAML) have been extensively pen-tested.

JWT is very similar to SAML, but is still evolving and the inconsistencies in implementations could make it frustrating to deploy successfully.

Both are based on sound cryptographic techniques and deploying them securely depends fundamentally on effective key management. Using a single private key for signing SAML Assertion or JWT Tokens for an excessive time period, volume of assertions/tokens, or after suspected compromise of a system with plaintext key access compromises the security of all federated services.

  • 1
    Hmm, just to confirm, assuming TLS, there are no security considerations for "leaking" this information, in this format, in the header? – A T Dec 29 '15 at 3:15
  • 1
    @AT yes, I'm assuming TLS. The encrypted/signed tokens/assertions are allowed and are safe to be exposed to the client. – Alain O'Dea Dec 29 '15 at 3:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.