2022 Developer Survey is open! Take survey.

Questions tagged [token]

DO NOT USE THIS TAG! For questions about CSRF-tokens, use [CSRF]. For questions about session IDs, use [session-management]. For questions about OAuth tokens, use [oauth] and [oauth2]. For questions hardware authentication tokens, use [hardware-token].

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
user avatar
  • 1
0 votes
0 answers
9 views

Best way to handle token authentication workflow on mobile apps

I'm working on a mobile application and I need to create a token-authentication workflow. So far I've pointed out main token: Token by reference, that are store in database, like (https://www.django-...
user avatar
0 votes
0 answers
27 views

How to use TokenAuthentication in mobile apps?

I'm working on a mobile application, using django rest-framework as backend, and I'd like to archive the maximum security possible. Now when the user log-in with email and password I generate a token, ...
user avatar
0 votes
0 answers
70 views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
user avatar
0 votes
1 answer
63 views

is it safe to read the jwt token before validating it?

is it safe to read the jwt token before validating it? my colleagues are implementing a "check jwt for aud value and route accordingly". this means that: First payload is being read by the ...
user avatar
  • 103
0 votes
0 answers
71 views

When using a cookie to header CSRF protection with JWTs, how to implement refresh tokens?

Scenario I'm working in the oAuth flow for a new app, which is currently laid out like this A React web App A Rails backend FusionAuth as an Authorization server We are using the oAuth2.0 ...
user avatar
0 votes
1 answer
91 views

Is braintree clientToken supposed to be public?

I'm building an app that uses Braintree for processing payments. According to the documentation, I need a server-side endpoint that returns the clientToken, which is then used to manage a user's vault ...
user avatar
0 votes
1 answer
105 views

What should I worry about when attaching a token to a request manually?

I'm developing a platform that has 2 parts: An API written using Laravel, that integrates with the database and provided data in a restful state. Multiple fronts that connect to the API and perform ...
user avatar
  • 111
0 votes
1 answer
118 views

Github.com token authorisation since 13th August, impractical?

Gihub removed password authentication: remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information. fatal: unable to access 'https://...
user avatar
3 votes
2 answers
592 views

What is the point of signing a JWT with a JWK if you need to communicate with the token issuer?

If I understand correctly, a JSON Web Token (JWT) can be asymmetrically signed with a special private key (JWK). At least in some common configurations, the public part of the signing key can't be ...
user avatar
2 votes
2 answers
112 views

Frontend authenticates in server using jwt token issued by another server

I have two servers and frontend client: one server authorize and authenticate user, after that issue jwt token to client. Frontend client also visits second backend server using jwt token as ...
user avatar
0 votes
0 answers
117 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
user avatar
  • 111
0 votes
1 answer
156 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...
user avatar
0 votes
3 answers
224 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
user avatar
  • 196
1 vote
1 answer
167 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
user avatar
  • 111
2 votes
2 answers
92 views

Check Expired Token (after a visit)

I'm implementing a model which I'll have to reupdate the users, so I want to deliver a unique link to the users and after confirmed the update, I expire that link, so I prevent reusing that link. How ...
user avatar
1 vote
0 answers
163 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
user avatar
  • 421
2 votes
1 answer
91 views

Kubernetes bootstrap token with no expiration

I would like to know the security implications of using a bootstrap token that never expires. The reason why I'm considering doing that is that I'm using terraform and my control-plane is in a ...
user avatar
1 vote
1 answer
516 views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
user avatar
1 vote
0 answers
89 views

mORMot 1.18 doesn't invalidate session_signature after logout? is this the default behaviour?

On a website which uses mORMot 1.18 every request made by an authenticated user is in this format: ../search_items?session_signature=0000004C000F6DD02E24541C as reported within the framework docs ...
user avatar
  • 477
0 votes
1 answer
475 views

How to securely store and use session IDs

I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each). Given that the session ID is generated with enough entropy and that the session ID is then ...
user avatar
1 vote
1 answer
507 views

How do I maintain/check a user session in the backend without having to use tokens?

I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session. I have searched some solutions but I couldn't find any answer for my problem/...
user avatar
2 votes
1 answer
453 views

When to request refresh token? JWT

I am trying to implement JWT in a secure way in Node.js and I am unsure when to request the refresh token. I got one access token and one refresh token. Both are saved in two httpOnly cookies. When ...
user avatar
1 vote
1 answer
90 views

What happens if a secure token is provided to a trusted party that gets compromised

Take for example - AWS STS token or JWT tokens. Let’s say node A got a token for accessing a resource of account X on behalf of account X. Access includes read/write privileges. Let’s say few minutes ...
user avatar
  • 133
1 vote
0 answers
269 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
user avatar
  • 51
0 votes
1 answer
179 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
user avatar
2 votes
2 answers
529 views

What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?

From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
user avatar
3 votes
0 answers
434 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
user avatar
  • 131
0 votes
1 answer
111 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
user avatar
  • 13
1 vote
2 answers
581 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
user avatar
2 votes
1 answer
577 views

Why is ID token used instead of Access token to get temporary credentials in AWS?

After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc.. From all standards - ID token should not be used to gain access ...
user avatar
  • 189
0 votes
0 answers
78 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
user avatar
  • 2,033
1 vote
2 answers
1k views

Sending token through GET vs POST

Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server. There are two options: Sending token through Headers as part of HTTP GET ...
user avatar
  • 13
0 votes
1 answer
124 views

Using Refresh Token inside of Access Token without HTTPS

I previously read that Access Token must be sent with every request to the API but Refresh Token must be sent ONLY when the Access Token expires. I'm trying to use a similar model to the conventional ...
user avatar
0 votes
2 answers
253 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
user avatar
16 votes
3 answers
5k views

Am I generating email link tokens correctly?

I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...). There are ...
user avatar
  • 261
0 votes
3 answers
479 views

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this: { "username": "lukas", "isAdmin": true } The ...
user avatar
1 vote
1 answer
92 views

What is the proper way to sign up a user with a REST API?

I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain (user@example.com). I have a working API written in ...
user avatar
0 votes
1 answer
453 views

Token and cookie based mechanisms: stateful or stateless, session or nonsession based?

Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some ...
user avatar
  • 617
0 votes
0 answers
224 views

Firebase token storage on logout

We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity ...
user avatar
1 vote
0 answers
342 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
user avatar
  • 111
0 votes
1 answer
79 views

Understanding patch for my report

I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on I still want to try and bypass things but I don't ...
user avatar
  • 1
2 votes
0 answers
132 views

Passing 3rd Party Access Token in redirection URL of 3rd Party Website

I am integrating a website with 3rd party API. The 3rd party site allows me to generate Access Token by using Client Key/Client Secret. In one of the pages, I need to redirect to 3rd party site 's ...
user avatar
-1 votes
1 answer
142 views

Passing data from Mobile APP (Android / iOS) to the web UI of the application

We want token of the user generated in Mobile App SignIn to be transferred to the WebUI what would be the better approach for sharing confidential data to the WebUI. Do we follow something like https:...
user avatar
0 votes
1 answer
130 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
user avatar
  • 301
4 votes
1 answer
292 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
user avatar
3 votes
0 answers
121 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
user avatar
2 votes
2 answers
517 views

Do you really need an access token and refresh token?

When using a single page application, in what way is access token + refresh token more secure than a single token in a cookie with SameSite: strict. Given the browser supports SameSite. I completely ...
user avatar
1 vote
1 answer
258 views

Double Submit Cookie: Can the attacker set the cookie as a separate header?

I’m using an HttpOnly cookie to store authentication token client-side. To mitigate some of the risks of CSRF attacks, I’m employing the Double Submit Cookie pattern. The same token is saved client-...
user avatar
  • 145
3 votes
2 answers
1k views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
user avatar

1
2 3 4 5