Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [access-token]

An access token is an object encapsulating the security identity of a process or thread. A token is used to make security decisions and to store tamper-proof information about some system entity.

Filter by
Sorted by
Tagged with
0 votes
2 answers
117 views

"Duplicate" of Chrome Tabs causes stale tokens

Our implementation for authentication works like this User provides username/password to /login API API returns access token and refresh token in payload We store the access token and refresh token ...
Vin Xi's user avatar
  • 53
0 votes
1 answer
58 views

Is there any benefit to using refresh tokens if the session token is an opaque token stored in a database?

I'm working on a personal project that is an app that deals with user mental health data. Because of the sensitivity of the data, and the fact that the app syncs with the cloud as apposed to loading ...
Gradyn Wursten's user avatar
0 votes
1 answer
139 views

How do you prevent hackers from taking a "publicly used API key" and using it in their own script?

At first, for MVP, I want to basically allow API requests to only come from my domains, or from a server-side script I control. For the server-side script, I can simply use a "secret API token&...
Lance's user avatar
  • 632
2 votes
1 answer
91 views

Does saving the cookie or jwt token in the browser raise a security risk?

I have an admin screen, once I access it, it asks for login credentials, then after I login, I get a token that is saved under local storage (see screenshot below) Noting that I am using edge browser ...
anonymous's user avatar
29 votes
5 answers
4k views

Why are refresh tokens treated differently than access tokens

If we consider that having a valid refresh token allows you to get a valid access token, then the two can be considered to have the same 'informational value' right? Then why are they treated ...
Javiliano's user avatar
  • 409
0 votes
1 answer
220 views

Secure access and refresh token handling in a SPA

I am trying to figure out how to handle access and refresh tokens securely on the front end in a SPA. After doing a lot of reading, I still have questions/doubts about the proposed solutions I found ...
tech-ebe's user avatar
3 votes
1 answer
976 views

Showing prefix of token in error message?

In our development context we have a lot of different tokens. If a developer gets "permission denied", it is often not immediately clear which token was used. I would like to improve the ...
guettli's user avatar
  • 81
0 votes
0 answers
65 views

How should the grant type of an oauth2 access token be preserved after refreshing it using refresh grant?

Let's say I got an access token of the "authorization code" grant type. After the expiration of it, I would refresh it using the refresh grant. Then I'll get a new token. Is the grant type ...
Agent47's user avatar
0 votes
1 answer
134 views

No csrf token, instead sessiontokens?

Will a random-generated-session-key be enough, so that I can end the usage of csrf token? The front end, will receive the token when logged in. It will be stored in «local storage» at the client’s ...
OrangeSquare's user avatar
1 vote
2 answers
752 views

Do we really need refresh tokens?

I have read a number of posts of many people expressing their confusion around the extra security gained from using an access token and a refresh token to control access to a resource API. Picking up ...
ASP's user avatar
  • 119
0 votes
1 answer
231 views

is access token using SHA256 secure?

I want to create a server where after the user logs the server gives them a randomly generated access token that is hashed using SHA256, that I store in the database a long with an expiration date, I ...
a_duck's user avatar
  • 1
0 votes
2 answers
393 views

can we use access token as session cookie in browser? and how to protect it?

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
Illakiya 's user avatar
1 vote
0 answers
155 views

Best practices for access and refresh tokens timeout lengths [duplicate]

I'm currently working on an international marketplace website and trying to decide the appropriate timeout lengths for access and refresh tokens. We try to do the timeouts to be as strict as possible ...
Arnas Savickas's user avatar
0 votes
1 answer
145 views

token leak by copying cookie

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
Jacson - ANLS's user avatar
1 vote
0 answers
194 views

JWT access vs refresh tokens

I have an application that I want to secure with JWT tokens. For what I have read, the common practice is to have very short lived access tokens and very long lived refresh tokens, so that when an ...
chronos's user avatar
  • 111
0 votes
2 answers
834 views

Can UUID v7 be treated as a unguessable, opaque identifier?

RFC4122bis specifies UUID v7, a version which contains 74 bits of randomness. Assuming I use a CSPRNG to generate the random bits: Are these UUIDs considered to be unguessable and are enough to ...
Jonas's user avatar
  • 105
1 vote
0 answers
272 views

Cannot `qwinsta` during WinRM, but it works when run under `NewCredentials` logon type

When I try to WinRM into a Windows host (with a tool like evil-winrm) into the and when I do qwinsta, it says "No sessions exists for *", however, when I do RunasCs.exe x x "qwinsta&...
kizzx2's user avatar
  • 111
3 votes
1 answer
688 views

Best login flow for username and password authentication

I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now. My scenario: I have a simple app (capacitor spa) that has a simple ...
HRdev's user avatar
  • 33
0 votes
0 answers
132 views

Two-Factor authentication bypass

I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments. I ...
week's user avatar
  • 101
1 vote
1 answer
207 views

CryptoKey with IndexedDB to secure stateless authentication

Stateless authentication using e.g. JWT can be dangerous as they are non-revocable and can leak giving full access. But they are really flexible. I'm considering a scenario where the issued JWT is ...
Szyszka947's user avatar
0 votes
0 answers
125 views

What type of token is this?

I started noticing this kind of token in a lot of CTF tasks from different authors: eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk The structure is as follows: ...
Andrey's user avatar
  • 3
2 votes
1 answer
1k views

Re-authentication with biometrics in a mobile app using access token

My mobile app has this (fairly common) authentication user experience: user signs in with email and password user is prompted to enable biometrics for faster access next time when user returns to app ...
Tamlyn's user avatar
  • 175
0 votes
1 answer
81 views

Is create a key to access resources than send it to client instead of login/password system , a good idea?

I would like to make a key/string/token encrypted string to send it to the user via email. This encrypted KEY would have encrypted data (resource id) and would be stored in the database along with ...
V S Vuca's user avatar
0 votes
3 answers
166 views

Security implications of using the current session to mint new access tokens

I saw a setup recently where frontend and resource servers were hosted on subdomains of the same second level domain. E.g. ui.example.com and api.example.com. It had an interesting authentication flow ...
Packager's user avatar
0 votes
2 answers
239 views

Data Model for JWT claims

I'm implementing a JWT-based REST API for the first time and I'm trying to figure out what information to send back on the response entity when a user logs in. The strategies I am considering are: ...
hotmeatballsoup's user avatar
1 vote
2 answers
7k views

How to pass authentication to iframe from host app?

I will implement a chat bot web app that can be used on other websites. I plan to to host this app in www.mysite.com and customers will be able display this chat bot inside an iframe on their sites. ...
Ismail's user avatar
  • 11
1 vote
2 answers
895 views

Does a web access token need to be encoded?

Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
dabadaba's user avatar
  • 111
0 votes
1 answer
116 views

what is the security/verification system paypal IPN use called?

In the implementation of an IPN listener: https://developer.paypal.com/api/nvp-soap/ipn/IPNImplementation/ I understand the IPN listener verifies that the message sent to it comes from paypal by using ...
yeahman's user avatar
  • 101
1 vote
2 answers
794 views

I need to generate a token in order to share an 'invite' link, what should the token be?

Just to elaborate a bit more: User A owns a directory of files on my server User A wants to share a link with a token that grants anyone with the link access to that directory I have an API user A ...
DanDev's user avatar
  • 31
0 votes
1 answer
672 views

The reasoning behind having access and refresh tokens for a single user SPA

I'm trying to improve security in my single page application. Before I had only one JWT that was stored in the browser's localStorage and expired in one day. I've improved security by adding refresh ...
Chaz Ashley's user avatar
2 votes
1 answer
1k views

Best Way to handle Authorization tokens on mobile apps

in our organization we have our own OpenId server (Identity Server) that we use to authenticate people into our applications, let me explain how we currently handle our web clients. so we have an API ...
MoTahir's user avatar
  • 121
0 votes
1 answer
417 views

Bearer JWT client authentication and access token issued by authorization server

An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
user890234's user avatar
1 vote
1 answer
307 views

Azure Shared Access Signature (SAS) token security

I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible. When I generate a connection string there is a SAS token embedded in the URL. That token has ...
Ozwel's user avatar
  • 173
2 votes
2 answers
1k views

Encrypted instead of signed access tokens in OAuth2

In OAuth2 access token is typically JWT signed by authorization server. Assuming that we will use Ed25519 to sign the JWT, we will have 128 bits of security. But what about access tokens that would be ...
Szyszka947's user avatar
0 votes
2 answers
145 views

Shred, cut, melt, smash, grind, then flush, is it secure disposal of a security access id card?

I had a card like a credit card that I used to use for work. It was an ID card, and it had an access code, a swiper, a barcode, my picture, my name, my rank, my license, the name of the company, and ...
A google worker's user avatar
0 votes
0 answers
386 views

Personal Access Tokens vs OAuth

We want users of our service to be able to write programs/scripts that act on their (i.e. the user's) behalf. I've seen various services (github, digital ocean, gitlab) use Personal Access Tokens (...
Sam's user avatar
  • 1
1 vote
1 answer
347 views

What is the significance of an app leaking its access token - knowingly/unknowingly with just read access

I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID ...
Supraja's user avatar
  • 23
2 votes
0 answers
136 views

What would be the most complete procedure to get a simple login system working securely?

I don't have formal CS education but i've written one or 2 little websites. I have troubles communicating even in my native language but i hope this is understandable. With simple i mean something ...
Silly_Code_Valley's user avatar
1 vote
0 answers
89 views

When apps like CI/CD require your github access token, how do they store it securely?

I'm facing a similar situation where I need to store users' access tokens, but I'm not sure how to securely store them in the server. I've only ever used a security manager for my tokens, and salt ...
user1164937's user avatar
1 vote
1 answer
1k views

Is there any danger in refreshing JWT tokens directly without a refresh token?

So I wrote the following logic for my web app: When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
Munchkin's user avatar
  • 264
1 vote
1 answer
92 views

Securely loading private tokens on a local machine

When doing local development, I have to export a token needed for downloading dependencies from a private repository. For example: export NPM_TOKEN=token_value I want to make sure that this token is ...
user73235's user avatar
8 votes
1 answer
6k views

PAT vs. SSH - Why Bother with SSH?

Are there any advantages to using SSH keys vs. a PAT when interacting with a site like Github? Github claims SSH keys are a way to not have to enter your username + password (personal access token) ...
stk1234's user avatar
  • 202
0 votes
2 answers
2k views

Is it acceptable to send an access token back to a browser client?

I am currently following the instructions for getting an access token on behalf of a Twilio user described here The part that is confusing me where it seems to generate an access token then proxy it ...
Jackie's user avatar
  • 261
0 votes
0 answers
71 views

What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?

Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
Richard Ward's user avatar
2 votes
1 answer
676 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
skillz21's user avatar
  • 123
1 vote
0 answers
139 views

Best way to handle token authentication workflow on mobile apps

I'm working on a mobile application and I need to create a token-authentication workflow. So far I've pointed out main token: Token by reference, that are store in database, like (https://www.django-...
Paul Rock's user avatar
  • 111
0 votes
0 answers
427 views

Good practice for generating opaque access-token

Restrictions: Access token will be short lived (2 minutes) Access token will be one-time use only. Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
MatthewAws's user avatar
0 votes
1 answer
198 views

is it safe to read the jwt token before validating it?

is it safe to read the jwt token before validating it? my colleagues are implementing a "check jwt for aud value and route accordingly". this means that: First payload is being read by the ...
Ion Utale's user avatar
  • 103
1 vote
0 answers
118 views

Refresh tokens in a web environment

As I understand it, the basic idea is that you have accessToken (15 minutes), and refreshToken (1 week), a few moments before the accessToken expires, you need to ask the server for a new accessToken. ...
SexyMF's user avatar
  • 171
1 vote
0 answers
131 views

Web password reset steps

I'm trying to implement authentication for users on a web page using JWT tokens and, so far, I can create users and authorize them. I'm now trying to write the password reset functionality and I think ...
mirkaim's user avatar
  • 11