Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [token]

DO NOT USE THIS TAG! For questions about CSRF-tokens, use [CSRF]. For questions about session IDs, use [session-management]. For questions about OAuth tokens, use [oauth] and [oauth2]. For questions hardware authentication tokens, use [hardware-token].

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Firebase Cloud Messaging (FCM) what is the impact of a exposed or leaked fcm_token?

When an attacker obtains such a token (via a broken webapp or jailbroken mobile phone), what would be the consequences? Would it be possible for an attacker to obtain messages with sensitive info (...
Booger21's user avatar
0 votes
1 answer
81 views

how to send cookies or token in local storage to a remote server using reflected XSS

I have an XSS vulnerability identified by <script>alert(1);</script> in the url. So when I put it in the url it gets executed (ex: www.example.com/admin/<script>alert(1);</script&...
anonymous's user avatar
0 votes
1 answer
73 views

How are Sentry's public key protected when the token is in front end code?

In Sentry's documentation they explain that you can use a public token to use their API; <script src="https://js.sentry-cdn.com/examplePublicKey.min.js" crossorigin="anonymous&...
Alexis Benoist's user avatar
0 votes
1 answer
86 views

Password-based encryption: keeping the user logged in without entering password again

Context I have a system where some of user's data is encrypted via AES. Each user has their own key K. When the user creates an account, the K is generated and encrypted with a key derived from ...
v_slav.b's user avatar
0 votes
0 answers
60 views

Modern security implementation: operation token sent to the bank by secure server

This post is related to this post on Android users stack exchange relating to conceiving of a variety of household situations and files and a post related to what immutable storage is which was ...
Joselin Jocklingson's user avatar
3 votes
1 answer
709 views

Best login flow for username and password authentication

I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now. My scenario: I have a simple app (capacitor spa) that has a simple ...
HRdev's user avatar
  • 33
1 vote
2 answers
805 views

I need to generate a token in order to share an 'invite' link, what should the token be?

Just to elaborate a bit more: User A owns a directory of files on my server User A wants to share a link with a token that grants anyone with the link access to that directory I have an API user A ...
DanDev's user avatar
  • 31
0 votes
0 answers
864 views

best way to keep user logged in with cookie and jwt?

I'm making an SPA with Laravel REST API and trying to keep it stateless. Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality. On successful login the client ...
Bufer's user avatar
  • 11
1 vote
1 answer
952 views

Authentication using JWT signature, without header and payload

I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key. One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
Nopx's user avatar
  • 113
1 vote
1 answer
116 views

Logging secrets in the user agent (browser)

There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7). But should the same rule apply on the client side? Is there a ...
Marek Puchalski's user avatar
2 votes
1 answer
4k views

Why do big sites use cookies and not OpenID connect?

As I understand it, OAuth is the natural evolution of authentication protocols I understand in a general way that evolution is as follows: basic authentication cookies tokens, at this point you want ...
user60108's user avatar
  • 187
0 votes
1 answer
172 views

GnuPG: gpa.exe hangs when I click on "smartcards" AND scdaemon cannot recognise SC-HSM 4K

https://dev.gnupg.org/T6097 I am trying to get GnuPG to work with my SmartCard-HSM 4K on Windows, using the GP4Win bundle. Kleopatra doesn't recognise the SC-HSM 4K at all, even though, it does ...
ARGYROU MINAS's user avatar
1 vote
0 answers
517 views

Bearer Token and session mangement

I'm working for a company and I saw their authentication mechanism and wasn't sure if it's good. When the user first logs in, the credentials will be sent to the server and the server will generate a ...
MR.-c's user avatar
  • 457
2 votes
0 answers
1k views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
John's user avatar
  • 21
1 vote
0 answers
139 views

Best way to handle token authentication workflow on mobile apps

I'm working on a mobile application and I need to create a token-authentication workflow. So far I've pointed out main token: Token by reference, that are store in database, like (https://www.django-...
Paul Rock's user avatar
  • 111
0 votes
0 answers
117 views

How to use TokenAuthentication in mobile apps?

I'm working on a mobile application, using django rest-framework as backend, and I'd like to archive the maximum security possible. Now when the user log-in with email and password I generate a token, ...
Paul Rock's user avatar
  • 111
0 votes
0 answers
4k views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
NoDiggityNoDoubt's user avatar
0 votes
1 answer
199 views

is it safe to read the jwt token before validating it?

is it safe to read the jwt token before validating it? my colleagues are implementing a "check jwt for aud value and route accordingly". this means that: First payload is being read by the ...
Ion Utale's user avatar
  • 103
1 vote
1 answer
340 views

Is braintree clientToken supposed to be public?

I'm building an app that uses Braintree for processing payments. According to the documentation, I need a server-side endpoint that returns the clientToken, which is then used to manage a user's vault ...
David Bryant's user avatar
0 votes
1 answer
277 views

What should I worry about when attaching a token to a request manually?

I'm developing a platform that has 2 parts: An API written using Laravel, that integrates with the database and provided data in a restful state. Multiple fronts that connect to the API and perform ...
Johansson's user avatar
  • 111
0 votes
1 answer
159 views

Github.com token authorisation since 13th August, impractical?

Gihub removed password authentication: remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information. fatal: unable to access 'https://...
run_the_race's user avatar
4 votes
2 answers
2k views

What is the point of signing a JWT with a JWK if you need to communicate with the token issuer?

If I understand correctly, a JSON Web Token (JWT) can be asymmetrically signed with a special private key (JWK). At least in some common configurations, the public part of the signing key can't be ...
user986730's user avatar
2 votes
2 answers
436 views

Frontend authenticates in server using jwt token issued by another server

I have two servers and frontend client: one server authorize and authenticate user, after that issue jwt token to client. Frontend client also visits second backend server using jwt token as ...
Rudziankoŭ's user avatar
0 votes
1 answer
352 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...
Johnson87's user avatar
0 votes
3 answers
682 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
S. Imp's user avatar
  • 216
1 vote
1 answer
362 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
Grogu's user avatar
  • 111
2 votes
2 answers
172 views

Check Expired Token (after a visit)

I'm implementing a model which I'll have to reupdate the users, so I want to deliver a unique link to the users and after confirmed the update, I expire that link, so I prevent reusing that link. How ...
G. Manucci's user avatar
2 votes
0 answers
728 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
Mik378's user avatar
  • 431
2 votes
1 answer
245 views

Kubernetes bootstrap token with no expiration

I would like to know the security implications of using a bootstrap token that never expires. The reason why I'm considering doing that is that I'm using terraform and my control-plane is in a ...
MyUsername112358's user avatar
2 votes
1 answer
1k views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
fragile_frogs's user avatar
1 vote
0 answers
140 views

mORMot 1.18 doesn't invalidate session_signature after logout? is this the default behaviour?

On a website which uses mORMot 1.18 every request made by an authenticated user is in this format: ../search_items?session_signature=0000004C000F6DD02E24541C as reported within the framework docs ...
Maicake's user avatar
  • 567
2 votes
2 answers
4k views

How to securely store and use session IDs

I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each). Given that the session ID is generated with enough entropy and that the session ID is then ...
Shoe Diamente's user avatar
1 vote
1 answer
2k views

How do I maintain/check a user session in the backend without having to use tokens?

I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session. I have searched some solutions but I couldn't find any answer for my problem/...
Thiago G's user avatar
2 votes
1 answer
2k views

When to request refresh token? JWT

I am trying to implement JWT in a secure way in Node.js and I am unsure when to request the refresh token. I got one access token and one refresh token. Both are saved in two httpOnly cookies. When ...
Hejhejhej123's user avatar
1 vote
1 answer
120 views

What happens if a secure token is provided to a trusted party that gets compromised

Take for example - AWS STS token or JWT tokens. Let’s say node A got a token for accessing a resource of account X on behalf of account X. Access includes read/write privileges. Let’s say few minutes ...
user855's user avatar
  • 133
1 vote
0 answers
452 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
loutsi1's user avatar
  • 51
0 votes
1 answer
375 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
lecarpetron dookmarion's user avatar
6 votes
2 answers
2k views

What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?

From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
João Pinto's user avatar
3 votes
0 answers
1k views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
alloy's user avatar
  • 131
0 votes
1 answer
389 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
William's user avatar
  • 13
1 vote
2 answers
1k views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
Zefiro38's user avatar
2 votes
1 answer
1k views

Why is ID token used instead of Access token to get temporary credentials in AWS?

After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc.. From all standards - ID token should not be used to gain access ...
ArielB's user avatar
  • 189
0 votes
0 answers
112 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
Sayan's user avatar
  • 2,031
1 vote
2 answers
4k views

Sending token through GET vs POST

Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server. There are two options: Sending token through Headers as part of HTTP GET ...
b0n40me's user avatar
  • 13
0 votes
1 answer
414 views

Using Refresh Token inside of Access Token without HTTPS

I previously read that Access Token must be sent with every request to the API but Refresh Token must be sent ONLY when the Access Token expires. I'm trying to use a similar model to the conventional ...
user-2147482509's user avatar
0 votes
2 answers
638 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
shubham shreyash's user avatar
16 votes
3 answers
6k views

Am I generating email link tokens correctly?

I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...). There are ...
Baterka's user avatar
  • 261
0 votes
3 answers
948 views

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this: { "username": "lukas", "isAdmin": true } The ...
TheProgrammer's user avatar
1 vote
1 answer
135 views

What is the proper way to sign up a user with a REST API?

I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain ([email protected]). I have a working API written in ...
Techy Ty's user avatar
  • 113
0 votes
1 answer
877 views

Token and cookie based mechanisms: stateful or stateless, session or nonsession based?

Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some ...
Tim's user avatar
  • 657

1
2 3 4 5