My application is running an API authentication that uses tokens rather than cookies.
This leads me to ask a few questions :
- What is the most secure way to store the token ?
By using random tokens you eliminate the issue of CSRF attacks but on the other side there are no
I thought of maybe using some kind of trick using the new ECMAScript Harmony
Object.seal() features but this seems to be more of a hack than something that would be secure.
- How should I authenticate
Socket.ioon top of HTTPS ?
Most libraries like
Faye don't allow to set custom HTTP headers or it's not compatible with the various fallback protocols like Flash sockets.
One possibility would be to send the token as part of the handshake in the URL's query arguments but I don't really like it because it means that :
1) - Tokens will be shown in logs files that log only the URL
2) - I would have to authenticate first during the handshake and then every time I send data which would mean two separate systems.
That's just on top of my head by thinking a little bit about it. There might be some more underlying issues.
- Am I just too paranoid and this option is actually secure ?
I could also implement some kind of asymmetric scheme using a public / private key system, but this seems just to error prone / complicated to be a reliable solution.
My final question is more of a consequence of the questions above :
- Is the trade-off of having random tokens rather than cookies worth it ?
On one side you don't have CSRF attack vulnerabilities but on the other side you have a lot of other cases where the answers (for me at least) doesn't seem to be so clear-cut.
Thank you in advance !