I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any best practices for generating authorization code and access_token.
Our backend is written in Node.js, so I am using uuid v4 for both codes and access tokens. Historically, I've seen code's to be shorter than uuid v4, around 6-8 characters long. And recently, I've seen tokens in Slack API be likely something else.
Now, I know uuid is considered to be unguessable, we also use a code only one time, and the code is short-lived. Is there anything else that can improve the quality (or unguessability) of the codes and access tokens?
Additionally, does it make sense to hash the codes and access tokens inside database? What is the optimal hash function for it? Right now we use
sha256 in similar places.