I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...).
There are a few things that are mandatory:
Token must be unique (even when two generated at the same time) in system (in database)
Token must be one-time use
- Token must have expiration
- Token cannot be guessable
From that I decided to generate token like this:
token = sha256(user.id + time + uuid(v4) + secret)
This token do not need to carry any expiration information, because it is saved in database with those columns externally.
- Does this token meet my requirements above points? If not, how to modify my approach?
- If this token meets my requirements, is there a way to simplify it while meeting my goals?
I am asking this, because I know there are some known exploits of those types of one-time use tokens sent to email and I am not sure if I will be safe.