Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [token]

DO NOT USE THIS TAG! For questions about CSRF-tokens, use [CSRF]. For questions about session IDs, use [session-management]. For questions about OAuth tokens, use [oauth] and [oauth2]. For questions hardware authentication tokens, use [hardware-token].

1
vote
0answers
37 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
0
votes
0answers
24 views

How would attackers bypass Token Binding?

Token binding is not easy to implements across organizations to support Bearer Tokens. The problem with Bearer Token is that merely having it even if it was stolen will be enough to use (same idea as ...
0
votes
1answer
111 views

Multiple devices authorization with refresh tokens

I don't really understand at all the protection scenario when a refresh token is stolen. Please explain. Let's say there is this situation: the user is authorized in a mobile app and this app ...
2
votes
0answers
34 views

Issuing Personal Access Tokens for my APIs

I have an intranet site, hosted locally within my organisation. The same site also exposes some data through various web services. It's written using ASP.NET MVC 5 and WebAPI 2. At the moment users ...
0
votes
0answers
28 views

Static callback URLs security

I've a web application and a REST service deployed on two different servers. The user performs the login on the web application, then he/she must be able to download some private files from the ...
2
votes
1answer
323 views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
1
vote
1answer
135 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
0
votes
0answers
30 views

Giving API identifiers to client-side

Context I'm creating a backend right now that has unique identifies (self-created) for each user and also needs to store certain "tokens" or other identifiers for a couple different third-party APIs. ...
0
votes
0answers
23 views

What's the point on authenticating token with HMAC? [duplicate]

I have read here that is a good practice to authenticate a token with HMAC, but I do not understand why it is important and what are the benefits.
0
votes
0answers
14 views

OAuth, store dedicated PPK with source code?

Scenario I am accessing the REST API of some application using OAuth. This is what happens: I generate a openssl private/public key pair. The private portion stays with my app, the public part goes ...
6
votes
2answers
148 views

Is a user being able to view their own UID a security risk?

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first. ...
0
votes
0answers
44 views

What are the risks with using the same token for Mobile auth and Web auth?

wondering if any security professionals can come up with an attack vector involving this scenario: Web uses cookie authentication Mobile uses static token in headers Value of web cookie and mobile ...
-1
votes
2answers
742 views

Does the TOTP Algorithm rely on the client time always being synced correctly?

What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the TOTP (Time-based OTP) algorithm generate an invalid token? Also, do time zones play a ...
1
vote
1answer
303 views

Stealing tokens from client PC on a domain controller?

I'm trying to hack my domain controller lab. I created a lab with 4 PC's and 1 servers (2012 R2). I succeeded in hacking one of the PC's via the EternalBlue exploit. So when I run whoami i got : NT ...
1
vote
0answers
697 views

Is CSRF token managed through HTTP headers safe?

I'm building a CSRF protection on my application, and I am wondering on the best (or let's say least unsecure) way to transmit my CSRF token. The application enforces HTTPS, with TLS1.2. When I ...
2
votes
1answer
110 views

Security considerations for a web application without log in feature

We were told to send an email with a link to the users. The users will get a token in the URL where they will be able to chose some options and post their selection. Example URL: https://example.com/...
5
votes
1answer
1k views

How to allow users to connect from multiple devices with refresh tokens?

This question follows my previous one: How to securely keep my users signed in with refresh tokens? What I got from this previous question, is that we need: short-lived access tokens long-lived one-...
1
vote
0answers
182 views

Is access token saved in Cache.db-wal bad for iOS app?

tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
0
votes
4answers
690 views

How random token protect against CSRF

Generally we know that a random token added to each request is a good solution against CSRF. But how exactely is it work? The web server generates token, sends it to client in hidden form, than this ...
8
votes
6answers
2k views

Protect PHP hashing algorithm (from bots)

First of all, I'm new to this whole crypto thing. Here's my scenario: I have a client app, that sends a 20char max string to my server. The server then checks if the name is indeed matching the char ...
1
vote
1answer
457 views

Can an SSL certificate be used to generate a SAML token

An external application (B) requires a SAML token to allow users who log into my application (A) to access it directly without having to log in again. This access is not built yet. My organization has ...
1
vote
1answer
343 views

Is refresh token nessesary with HTTPS

I fully understand the benefits of refresh token in the case that Access Token gets compromised. I send JWT access token to the server only through HTTPS for a mobile application and web application ...
2
votes
1answer
474 views

What's the state-of-the-art approach to secure a backend API?

Scope Currently we are developing a backend REST API which is consumed by handful of MVC applications. In this case we are talking only about server-server communication and the API won't be consumed ...
2
votes
2answers
107 views

Token generation and random numbers

I have a swift server, where currently authentication is handled through a simple email+hashed password combination. I want to replace this with an access token ( + expiration ) so I can remove the ...
0
votes
1answer
592 views

Does credit card tokenization have an expire date?

I am reading the tokenization product security guidelines of PCI-DSS but I do not see the time of expiration of the token. Does it have it?
0
votes
0answers
88 views

Why does hackers use privilege escalation via impersonation token instead of simpler method

To get SYSTEM permission on a compromised system, attackers usually use a method to gain privileges via named pipes with impersonation token. Even if, at this moment, I don't fully understand the ...
0
votes
1answer
1k views

Is Redux a secure place to store JWT tokens?

I've been teaching myself Redux, wondering how secure it is to store JWT tokens in a state of Redux. For example, here is a reducer which is responsible for setting and resetting a token. export ...
3
votes
2answers
204 views

Stateless secure token that can expire?

I want to generate a link that will be given to a user. On this link, as a parameter, I will add a token that will be valid only for a few days. So after that time, the server will check the token, ...
-1
votes
1answer
97 views

What's the minimum access code length considered secure?

I'm building a remote management software that will allow remote access to work equipment. To get access, the user will have to enter a code which is shown on the device to be accessed. The user will ...
1
vote
0answers
166 views

JWT refresh flow generally secure?

I will be using JWT for authentication for my REST API. I am using third party cloud services and database write are very expensive so I am trying to avoid writing to the database as much as I can. ...
1
vote
2answers
167 views

Creating my own tokens to secure communication with my API

I have an API communicating with my client, now I want to secure that API so that onlyu my client can use it. I am planning to do the following, since I have no experience in this I have gathered all ...
0
votes
2answers
202 views

Best and secure way to do a authentication protocol between Restfull webservice and Android client

Im developing a system which a android client send and receive data from a mysql database (connected to a java restfull webservice). To do the authentication method, i dont want to send id&pass ...
1
vote
0answers
289 views

How do I handle refresh tokens that are lost in transit?

I have a scenario where a user has a refresh token. As that token is getting ready to expire, the client sends the refresh token to the auth server to get a new refresh token. This usually happens on ...
0
votes
1answer
212 views

Is this authentication scheme using JWT secure?

I was wondering if you could review this authentication scheme for web application. === Login Page === Credentials Verification => Server issues JWT => Stored in a Cookie JWT contains: exp: ...
0
votes
1answer
287 views

Is this token authorization scheme secure?

I have Web application, name it A, from which user should be able to login to another one B (developed by other company) without typing any logins/passwords. We have thought up following scheme: We ...
1
vote
0answers
21 views

Using RSA SecureID how to ensure restriction of use concept?

I want to know using RSA SecureID, (soft tokens) what is the mechanism that ensure that user is logged in to the system from the authorized station only. How is the passcode bind to the user and the ...
5
votes
1answer
84 views

Multipurpose security token a security vulnerability?

Our application has the concept of security tokens. These are cryptographically secure randomly generated strings used when generating password reset emails, as well as email confirmations for other ...
0
votes
1answer
620 views

Securing Authentication Tokens Stored in the Server-Side Database

I'm working on extending a web application with a RESTful HTTP-based API. We decided to require the client to supply an authentication token in each request (instead of using sessions or other multi-...
1
vote
2answers
336 views

Is there an advantage to using hardware 2FA over SMS when both are available? [duplicate]

A bank offers two factor authentication in two forms. The first is SMS to a registered phone number (registration done at bank branch). The second is a provided hardware token. Both options are ...
2
votes
0answers
615 views

SignalR authentication security

I would like to ask a question about security in the case of SignalR, a library for real-time HTTP communication. I see it as an abstraction layer for web-sockets with fall-back mechanisms in case the ...
1
vote
0answers
421 views

Storing password or access token in standalone Java app

I have a simple Java app that use Eclipse JGit to pull remote repositories into the app to analyze and provide the user with code metric details on their projects. This app is supposed to be able to ...
2
votes
3answers
2k views

TLS to secure Basic HTTP Auth

Basic Auth, including Bearer tokens, depend on using TLS to prevent eavesdroppers from getting at your sensitive credentials or tokens. But I think there is an Elephant in the room that nobody talks ...
1
vote
1answer
443 views

Sharing a JWT between devices in close proximity of each other

Setup: iPhone (let's assume 6 and newer for the sake of this question). Raspberry Pi 2. The Raspberry runs a REST web service which the iPhone queries. The web service uses JSON Web Tokens for ...
3
votes
2answers
1k views

How to make user token and where to store it (server side)

I'm building an iPhone application and don't want the user to have to sign in every time they open the app, so I want to use user tokens. My question is is there a commonly accepted way to create user ...
2
votes
1answer
165 views

Authentication Token storing after database authentication

I've worked on a Spring 4 MVC RESTful backend application. We authenticate to an OpenAM server, and a lengthy token is stored in a cookie on the front-end. The front-end takes the token out of the ...
2
votes
2answers
312 views

Is this a good enough approach to securing a RESTful API?

I want to use token-based authentication where the user would log in with a username/password combination. The server would make sure the username and password match and then return a token which ...
1
vote
2answers
75 views

Sign in a user or not after they verify email address?

So in a typical web-app scenario, the new user is sent some sort of email with a one-time, time sensitive token link which when clicked will "activate" their account or "verify" their email address. ...
3
votes
2answers
728 views

Does expiring the OAuth refresh token at the same time as the access token have any utility? Or is it just security theater?

We are integrating with a vendor who have a unique (to us) OAuth 2.0 implementation: with every refresh request, they send us a new refresh token along with the access token. They say that this was ...
3
votes
3answers
236 views

Predictability of PHPs array_rand

It's generally known information that methods such as the array_rand() method in PHP are not considered cryptographically secure. I'm trying to understand under what situations generated result may be ...
0
votes
0answers
404 views

Token authentication storage & encryption/hashing

I'm currently studying token authentication for web and native applications, in order to make users authenticate without using their password all the time via HTTPS. I kind of understand how tokens ...