-1

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the login succeeded the server returns a randomly generated token the server stores and sends with any https post request it makes. The server verifies the received token is the one generated for that userid. The token has a timeout. Is this procedure secure enough? what weaknesses does it have?

UPDATE the problem is that it seems sessions are not supported by mobile applications (i.e. Android, iOS) and I have had to develop my own kind of sessions. However I am a bit afraid it is not secure enough.

4
  • 3
    You essentially describe OAuth2 en.wikipedia.org/wiki/OAuth#OAuth_2.0, and is pretty standard across web applications.
    – RoraΖ
    Aug 5, 2014 at 13:37
  • 2
    This is just an session/authentication cookie. Don't reinvent the wheel :)
    – Gudradain
    Aug 5, 2014 at 14:03
  • the problem is that it seems sessions are not supported by mobile applications (i.e. Android, iOS) and I have had to develop my own kind of sessions. However I am a bit afraid it is not secure enough. Aug 6, 2014 at 13:46
  • Are you sure the server stores and sends that? Is it generated by a CSRNG?
    – Tobi Nary
    Mar 19, 2016 at 9:34

1 Answer 1

0

Your login system seems good enough to provide basic authentication control, as you are describing an standard cookie-based HTTP authentication system.

But anyway, the best recommendation is: It's always better trying to use an standard, as the main security concern relating custom-made authentication/authorization systems is usually the implementation. You should try to avoid implementing your own authentication methods when you have an alternative.

So, if you are using any framework for developing your application, try to use the authentication methods provided by it !

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .