Imagine you are a cab company that subcontracts independent drivers to drive within certain cities and towns.

You send the subcontractor a link to a page that has fields for the subcontractor to enter and submit information (such as how much money they made on a job they were asked to do, or comments about the job). The subcontractor doesn't need credentials (an account with username and password) to access this link. They just need the link, which is specifically meant for them, and which has a query string parameter that is a randomly generated access token. The subcontractor entering and submitting information from the page led to by the link sends data to the company's database.

This access token at the end of the URL is meant to keep the page secure and accessible only by the subcontractor. The access token is also time based. The subcontractor has 24hrs to enter the information from that link.

What is your opinion? How secure is this? This reminds me of the password reset links that websites send out. What if instead of 24hrs the link lasted for 1 month?

  • What background information do you have for this ?homework? question? Have you researched the security of password reset links? What have you found? – Neil Smithline Sep 1 '15 at 1:29
  • Is it significantly more difficult for you to just generate a username + password and send it to them? – Nic Barker Sep 1 '15 at 2:44
  • Is the URL sent over SSL (HTTPS)? – user45139 Sep 1 '15 at 5:46
  • Keep in mind that this token might be stored in the cache, web server logs and proxy logs (if used). This is not the recommended way, especially when financial information is stored (confidentiality) What happens if an attacker gets the URL after the cab driver entered the details? Will the attacker see what's entered? Will data be overwritten? (integrity) – Jeroen Sep 1 '15 at 6:09
  • Not homework, I guess just me trying to be optimistic despite already realizing probably not a secure choice. Customer wants everything automated and I hoped this over the customer having to manually distribute a username+password for each driver would be faster. The url is not sent over SSL. In terms of integrity, what if a LOG of all entries is stored and from which IP address they came from? Anyways, I think I'm going to have to go with a username and password. – Adé Sep 2 '15 at 11:02

There are several scenarios you have to think about. If you are sending the URL over HTTP you (and your customers) are vulnerable to man-in-the-middle attack (the attacker will have access to the information sent to you by the subcontractors) and even if you are sending it over SSL that will protect your URL only during the transit, and if you are rely on emails to send it then SSL won't protect you from the insecurities of the email that may go through lot of servers before reaching your customer; and before all, it is a weak method to do so in that it is not supported by the merest authentication mechanisms (such as sessions).

Also the fact you need to send the URL subcontractor for each time you require his information, with its validity for 24 hours, expose you to more threats as it enhances the length of the attack surface. And if the URL is cached by the browser and a subcontractor may use it more than once (you did not specify this through your question) then even SSL is useless for this particular case.

There are other considerations to think about too: what about any internal routing, server logging?

For your last question:

What if instead of 24hrs the link lasted for 1 month?

Again, if you enhance the time validity of the URL you are enhancing in the same time the surface attack as the subcontractor email (or the system with which he receives your URL) may be compromised by time.

  • What if I send them the link PLUS text them a password they need in order to access that link? – Adé Sep 2 '15 at 11:15
  • @wizeird It will a good idea in the case they receive the password by SMS for example (2 authentication factor). That will enhance greatly the security of your present scenario (under the condition you are sending the URLs over HTTPS) – user45139 Sep 2 '15 at 11:25

Though, this sounds like homework, its possible that a technical person sometimes doesn't understand some things.

You need to make sure that the person entering the info is the one meant for it. The two standard way of checking john doe is actually john doe is to have their email and send the link to their email, or to have their phone(cell) and send random number via sms that they need to enter when they hit the link.

This doesn't talk about implimentation or other issues such as spam. You will have to brainstorm and think about those.


This is pretty secure, assuming you've put into place a way of dealing with collisions and someone randomly trying to guess other strings. Since it is over ssl, and assuming it's end to end terminated exactly at your server, is resistant to someone trying every combination for the validity period of the string, and the intermediate isps are not saving the url, it should be ok.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.