I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in.

Someone suggested that we make a token from this: base64urlencode(md5("salt-adid"))

  • adid is information known by the user.
  • salt is just a secret word.

Given this is this solution secure? The user can know the adid.

Will it be possible for a malicious user to calculate the url for stopping an ad?

How can this be change to be more secure?

EDIT: Xander pointed out that something was unclear and I will try and elaborate.

"It's not clear to me why you need a token at all. Is this just for some logged out users rather than all logged out users?"

It should not be possible for any user to stop the ad just to owner. We will be sending the url to the owner so he/she can use it if they want to stop the ad. So it is just for some logged out users.

  • 2
    Based on the scenario you describe, you are not actually using a logged out user, but rather a second login system with a cookie persisted session that doesn't actually require a login to start it. Commented Aug 28, 2014 at 14:14
  • I agree with AJ, are you saying that you want the publisher to turn on and off some value without logon? Without logon you are just relying on security by obscurity and could use any value. Please add more details to clarify.
    – Eric G
    Commented Aug 28, 2014 at 16:21
  • What type of details do you need Eric? =)
    – Anders
    Commented Aug 29, 2014 at 8:26
  • What happens is a user shares the "ad-free" URI? Will others be add-free, too?
    – U. Windl
    Commented Jun 29, 2023 at 12:25

1 Answer 1


Yes, if the "salt" is a secret word, it is possible for a user to calculate the hash by running a simple dictionary attack until they come up with the correct hash for their adid.

It's not clear to me why you need a token at all. Is this just for some logged out users rather than all logged out users?

Regardless, if you do need to provide the user with a token that they can't duplicate, it needs to have a message authentication code. If it's not secret (which it doesn't seem to be, since you said the adid which the user already knows will suffice) then use a MAC algorithm such as HMAC to ensure it can't be tampered with or forged.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .