Questions tagged [token]

DO NOT USE THIS TAG! For questions about CSRF-tokens, use [CSRF]. For questions about session IDs, use [session-management]. For questions about OAuth tokens, use [oauth] and [oauth2]. For questions hardware authentication tokens, use [hardware-token].

Filter by
Sorted by
Tagged with
1
vote
2answers
56 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
1
vote
1answer
48 views

Why is ID token used instead of Access token to get temporary credentials in AWS?

After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc.. From all standards - ID token should not be used to gain access ...
-1
votes
0answers
39 views

What conditions should trigger an invalidation of JWT Tokens?

I see many articles about how to invalidate JWT tokens but none about when to invalidate them before their expiry. When a user resets there password being an obvious time. What are the best practices ...
0
votes
0answers
35 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
0
votes
0answers
28 views

Email WebView Mini Browser - can login be secure?

We send transactional emails all the time. If the links opened in the main browser where the user actually has a session cookie, things would be fine. But these days, GMail etc. just launch the link ...
1
vote
2answers
84 views

Sending token through GET vs POST

Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server. There are two options: Sending token through Headers as part of HTTP GET ...
0
votes
0answers
24 views

Reuse Firebase Token for other authentication purporses

I'm building an app where the users should have restricted access to certain api-services. I use gRPC as API. Right now I'm asking the user's mobile number, send him an SMS with a code which he has to ...
0
votes
1answer
61 views

Using Refresh Token inside of Access Token without HTTPS

I previously read that Access Token must be sent with every request to the API but Refresh Token must be sent ONLY when the Access Token expires. I'm trying to use a similar model to the conventional ...
0
votes
2answers
65 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
16
votes
3answers
4k views

Am I generating email link tokens correctly?

I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...). There are ...
0
votes
3answers
144 views

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this: { "username": "lukas", "isAdmin": true } The ...
1
vote
1answer
48 views

What is the proper way to sign up a user with a REST API?

I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain (user@example.com). I have a working API written in ...
0
votes
1answer
136 views

Token and cookie based mechanisms: stateful or stateless, session or nonsession based?

Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some ...
0
votes
0answers
59 views

Firebase token storage on logout

We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity ...
0
votes
0answers
33 views

OAuth2 sent access token to server side after login

I am building an Ionic application that needs to have login buttons with major social sites and merge those accounts if that's the case (email or phone match). My concern is that by using the access ...
1
vote
0answers
104 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
0
votes
1answer
42 views

Understanding patch for my report

I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on I still want to try and bypass things but I don't ...
1
vote
0answers
23 views

Passing 3rd Party Access Token in redirection URL of 3rd Party Website

I am integrating a website with 3rd party API. The 3rd party site allows me to generate Access Token by using Client Key/Client Secret. In one of the pages, I need to redirect to 3rd party site 's ...
-1
votes
1answer
38 views

Passing data from Mobile APP (Android / iOS) to the web UI of the application

We want token of the user generated in Mobile App SignIn to be transferred to the WebUI what would be the better approach for sharing confidential data to the WebUI. Do we follow something like https:...
0
votes
1answer
66 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
4
votes
1answer
88 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
3
votes
0answers
75 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
1
vote
1answer
91 views

Do you really need an access token and refresh token?

When using a single page application, in what way is access token + refresh token more secure than a single token in a cookie with SameSite: strict. Given the browser supports SameSite. I completely ...
1
vote
1answer
61 views

How do I automatically add a user login token to my csrf page?

I'm testing my own system, and I was wondering if the csrf login token I created there could be obtained from the user session. For example; <input type="hidden" name="login&#95;token" value="...
1
vote
1answer
122 views

Double Submit Cookie: Can the attacker set the cookie as a separate header?

I’m using an HttpOnly cookie to store authentication token client-side. To mitigate some of the risks of CSRF attacks, I’m employing the Double Submit Cookie pattern. The same token is saved client-...
3
votes
2answers
444 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
2
votes
0answers
136 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
32
votes
3answers
4k views

Should I be able to see patterns in a HS256 encoded JWT?

I was fiddling with https://jwt.io/ using this header { "alg": "HS256", "typ": "JWT" } when I realized that replacing the payload name with something repetitive like AAAAAAAAAAAAAAAAAAAA would ...
0
votes
0answers
24 views

Token expiration for IdP to IdP federation

I am designing a set of micro-services and instead of having each one of them implementing authentication against the corporate IdP, I intend to propose another IdP on their end. The architecture ...
0
votes
3answers
215 views

Is an 8 characters long password reset token strong enough?

I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the ...
1
vote
1answer
296 views

Do I have to store refresh token in database?

If I generate refresh tokens with expire time of 14 days, do I have to store them in my database and compare them when an access token is renewed, or verifying them (with jwt library) is enough? Also, ...
1
vote
1answer
52 views

Why do we need the refresh_token OAuth flow?

In OAuth 2.0, I'm confused about hwy we need a refresh token flow. Per my understanding, when you submit a "refresh_token" grant type, you receive an access token, its expiration, and a refresh token....
1
vote
0answers
274 views

Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?

The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing. For a State(ful)-scenario (the Synchronizer Token Pattern), they write: ... for AJAX calls it is recommended to add ...
2
votes
2answers
158 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
0
votes
1answer
607 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
1
vote
1answer
183 views

Safe to switch from PBKDF2 to SHA-1 for token verification?

Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
1
vote
0answers
144 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
0
votes
1answer
95 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
0
votes
1answer
766 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
2
votes
1answer
955 views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
1
vote
1answer
525 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
0answers
357 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
0
votes
1answer
1k views

Multiple devices authorization with refresh tokens

I don't really understand at all the protection scenario when a refresh token is stolen. Please explain. Let's say there is this situation: the user is authorized in a mobile app and this app ...
2
votes
0answers
53 views

Issuing Personal Access Tokens for my APIs

I have an intranet site, hosted locally within my organisation. The same site also exposes some data through various web services. It's written using ASP.NET MVC 5 and WebAPI 2. At the moment users ...
3
votes
1answer
2k views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
1
vote
1answer
290 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
5
votes
2answers
323 views

Is a user being able to view their own UID a security risk?

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first. ...
0
votes
2answers
3k views

Does the TOTP Algorithm rely on the client time always being synced correctly?

What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the TOTP (Time-based OTP) algorithm generate an invalid token? Also, do time zones play a ...
1
vote
1answer
606 views

Stealing tokens from client PC on a domain controller?

I'm trying to hack my domain controller lab. I created a lab with 4 PC's and 1 servers (2012 R2). I succeeded in hacking one of the PC's via the EternalBlue exploit. So when I run whoami i got : NT ...
1
vote
0answers
1k views

Is CSRF token managed through HTTP headers safe?

I'm building a CSRF protection on my application, and I am wondering on the best (or let's say least unsecure) way to transmit my CSRF token. The application enforces HTTPS, with TLS1.2. When I ...