0

I am new to backend development and read about Authorization methods such as Basic, Bearer and OAuth 2.0. I haven't use any of these directly, but used a token based implementation.

User logs in with username and password -> if (correct) then generate token and send token to front end. The token is a encrypted value of a combination of username,userID, secret message and a random number calculated at runtime. For the user to make any requests after logging in, has to include the encrypted token in the header.

Since the HTTPS headers are encrypted, I can't think of a possible vulnerability to the system.

Currently just using a header with the name 'token' and the token value as it's value. Should I use the header "Authorization : Bearer " or "Authorization: Basic token==" for any reason? I want to know is this secure enough or are there better methods?

Improve this question
6
  • Secure against what? Why do you include the username and user ID in the token? Why not just use standard session management solutions? – Conor Mancone Sep 19 '20 at 11:07
  • "Since the HTTPS headers are encrypted, I can't think of a possible vulnerability to the system." - it is likely impossible to decrypt the header if this is what you mean with "possible vulnerability". The security requirements of the "system" though are likely much more complex than that, i.e. things like manipulation of the token (does your encryption has integrity checks?), replay attacks, CSRF ... . Nothing can be said about this since neither the exact encryption you use is known nor the security requirements of the system are known. – Steffen Ullrich Sep 19 '20 at 11:12
  • @ConorMancone only the user can make calls to the api, so security on that I guess. – jpj Sep 19 '20 at 11:23
  • 2
    Does the token expire or will it work no matter how much time has passed since login? Would the same token be accepted for several petitions or you generate a new one after each petition? Do you impose limits on username lentgh so your custom header does not get bigger than http header limits? Do you use strong encryption in the header or is it also a custom function? Does the frontend implement certificate/CA pinning so your app cannot be intercepted? Why do you try to make your own instead of any standard pre-existing solutions with well-documented cases of use? – NuTTyX Sep 19 '20 at 13:13
  • In what way can "only the user" make calls to the API? Although again, why are you putting both the username and userid in the auth token? On top of that, why are you using either in the first place? Why do you encrypt them? Why include random data? In essence: why have you chosen to build your token like you are? – Conor Mancone Sep 19 '20 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.