When implementing token-based authentication, is it recommended to regenerate secrets on a periodic basis? This is assuming the tokens generated have expiration.


The general guidelines here is; access to secret keys need to be highly restricted. For example, if this is a hard-coded secret, then any time someone with access to source leaves the company, then the secrets need to be rotated. Clearly hard-coding secrets is bad practice, and if secrets were properly stored in an HSM/KSM/CloudHSM then there is less pressure to rotate. Keep in mind, Yahoo stored the keys to the kingdom has a hard-coded secret in source control, so that anyone with access to source could then hijack 32 million email accounts (slow clap for the Yahoo security engineers).

tldr; rotate if you ever have reason to believe that the secret has been compromised.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.