4

What's the best way to share my access tokens? Is it okay to share it in the header as plain-text, or do I need to look into e.g. JWT?

Current workflow:

-> POST /api/login -d {**creds}
<- 201 [headers (including X-Access-Token)]
-> GET /api/secrets -H 'X-Access-Token: ""'

The header currently consists of:

X-Access-Token: <scope>::<uuid>::<expires_in>::<state>
Improve this question
2
  • 2
    Is your connection TLS, or plain HTTP? What is your concern?
    – xyz
    Dec 9, 2015 at 0:01
  • If you are providing a service then the best way to provide it is in the way that clients can use it (i.e. why not both)
    – symcbean
    Dec 9, 2015 at 0:17

1 Answer 1

Reset to default
1

If you are doing this for federated identity (single machine/human using multiple services) then use a purpose-built system for that.

Federated identity is hard to build correctly and unlikely to be important enough to your business to be a core competency that you'll justify maintaining properly.

I recommend using SAML 2.0 because it is broadly deployed and supported. Many implementations (including Shibboleth/OpenSAML) have been extensively pen-tested.

JWT is very similar to SAML, but is still evolving and the inconsistencies in implementations could make it frustrating to deploy successfully.

Both are based on sound cryptographic techniques and deploying them securely depends fundamentally on effective key management. Using a single private key for signing SAML Assertion or JWT Tokens for an excessive time period, volume of assertions/tokens, or after suspected compromise of a system with plaintext key access compromises the security of all federated services.

Improve this answer
2
  • 1
    Hmm, just to confirm, assuming TLS, there are no security considerations for "leaking" this information, in this format, in the header?
    – A T
    Dec 29, 2015 at 3:15
  • 1
    @AT yes, I'm assuming TLS. The encrypted/signed tokens/assertions are allowed and are safe to be exposed to the client.
    – Alain O'Dea
    Dec 29, 2015 at 3:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .