Questions tagged [token]

DO NOT USE THIS TAG! For questions about CSRF-tokens, use [CSRF]. For questions about session IDs, use [session-management]. For questions about OAuth tokens, use [oauth] and [oauth2]. For questions hardware authentication tokens, use [hardware-token].

Filter by
Sorted by
Tagged with
7
votes
4answers
2k views

Am I generating email link tokens correctly?

I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...). There are ...
0
votes
3answers
104 views

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this: { "username": "lukas", "isAdmin": true } The ...
1
vote
1answer
42 views

What is the proper way to sign up a user with a REST API?

I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain (user@example.com). I have a working API written in ...
0
votes
1answer
63 views

Token and cookie based mechanisms: stateful or stateless, session or nonsession based?

Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some ...
0
votes
0answers
51 views

Firebase token storage on logout

We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity ...
0
votes
0answers
32 views

OAuth2 sent access token to server side after login

I am building an Ionic application that needs to have login buttons with major social sites and merge those accounts if that's the case (email or phone match). My concern is that by using the access ...
1
vote
0answers
42 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
0
votes
1answer
40 views

Understanding patch for my report

I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on I still want to try and bypass things but I don't ...
1
vote
0answers
21 views

Passing 3rd Party Access Token in redirection URL of 3rd Party Website

I am integrating a website with 3rd party API. The 3rd party site allows me to generate Access Token by using Client Key/Client Secret. In one of the pages, I need to redirect to 3rd party site 's ...
-1
votes
1answer
29 views

Passing data from Mobile APP (Android / iOS) to the web UI of the application

We want token of the user generated in Mobile App SignIn to be transferred to the WebUI what would be the better approach for sharing confidential data to the WebUI. Do we follow something like https:...
0
votes
1answer
64 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
4
votes
1answer
80 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
3
votes
0answers
44 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
1
vote
1answer
53 views

Do you really need an access token and refresh token?

When using a single page application, in what way is access token + refresh token more secure than a single token in a cookie with SameSite: strict. Given the browser supports SameSite. I completely ...
1
vote
1answer
54 views

How do I automatically add a user login token to my csrf page?

I'm testing my own system, and I was wondering if the csrf login token I created there could be obtained from the user session. For example; <input type="hidden" name="login&#95;token" value="...
1
vote
1answer
73 views

Double Submit Cookie: Can the attacker set the cookie as a separate header?

I’m using an HttpOnly cookie to store authentication token client-side. To mitigate some of the risks of CSRF attacks, I’m employing the Double Submit Cookie pattern. The same token is saved client-...
2
votes
2answers
227 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
2
votes
0answers
100 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
32
votes
3answers
4k views

Should I be able to see patterns in a HS256 encoded JWT?

I was fiddling with https://jwt.io/ using this header { "alg": "HS256", "typ": "JWT" } when I realized that replacing the payload name with something repetitive like AAAAAAAAAAAAAAAAAAAA would ...
0
votes
0answers
21 views

Token expiration for IdP to IdP federation

I am designing a set of micro-services and instead of having each one of them implementing authentication against the corporate IdP, I intend to propose another IdP on their end. The architecture ...
0
votes
3answers
177 views

Is an 8 characters long password reset token strong enough?

I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the ...
1
vote
1answer
154 views

Do I have to store refresh token in database?

If I generate refresh tokens with expire time of 14 days, do I have to store them in my database and compare them when an access token is renewed, or verifying them (with jwt library) is enough? Also, ...
1
vote
1answer
48 views

Why do we need the refresh_token OAuth flow?

In OAuth 2.0, I'm confused about hwy we need a refresh token flow. Per my understanding, when you submit a "refresh_token" grant type, you receive an access token, its expiration, and a refresh token....
1
vote
0answers
217 views

Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?

The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing. For a State(ful)-scenario (the Synchronizer Token Pattern), they write: ... for AJAX calls it is recommended to add ...
2
votes
2answers
123 views

Token-based group invitation link

I've searched this site and the web for an answer to this question, but haven't found what I'm looking for, so here goes. Pointers to existing relevant answers are much welcome as well. I'm building ...
0
votes
1answer
466 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
1
vote
1answer
151 views

Safe to switch from PBKDF2 to SHA-1 for token verification?

Whenever I need to generate a token (email account confirmation, password reset, remember me cookie, view email in browser etc) I generate a string of random bytes (typically 32 using the Fortuna PRNG)...
1
vote
0answers
113 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
0
votes
1answer
88 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
0
votes
1answer
539 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
2
votes
1answer
799 views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
1
vote
1answer
406 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
0answers
336 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
0
votes
1answer
955 views

Multiple devices authorization with refresh tokens

I don't really understand at all the protection scenario when a refresh token is stolen. Please explain. Let's say there is this situation: the user is authorized in a mobile app and this app ...
2
votes
0answers
47 views

Issuing Personal Access Tokens for my APIs

I have an intranet site, hosted locally within my organisation. The same site also exposes some data through various web services. It's written using ASP.NET MVC 5 and WebAPI 2. At the moment users ...
3
votes
1answer
2k views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
1
vote
1answer
278 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
5
votes
2answers
278 views

Is a user being able to view their own UID a security risk?

Working on a web app with a token auth system, I'm wondering if giving a user access to view their own user id, a security risk? It won't be viewable easily, they'd have to hash a few cookies first. ...
-1
votes
2answers
3k views

Does the TOTP Algorithm rely on the client time always being synced correctly?

What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the TOTP (Time-based OTP) algorithm generate an invalid token? Also, do time zones play a ...
1
vote
1answer
574 views

Stealing tokens from client PC on a domain controller?

I'm trying to hack my domain controller lab. I created a lab with 4 PC's and 1 servers (2012 R2). I succeeded in hacking one of the PC's via the EternalBlue exploit. So when I run whoami i got : NT ...
1
vote
0answers
1k views

Is CSRF token managed through HTTP headers safe?

I'm building a CSRF protection on my application, and I am wondering on the best (or let's say least unsecure) way to transmit my CSRF token. The application enforces HTTPS, with TLS1.2. When I ...
2
votes
1answer
142 views

Security considerations for a web application without log in feature

We were told to send an email with a link to the users. The users will get a token in the URL where they will be able to chose some options and post their selection. Example URL: https://example.com/...
7
votes
1answer
5k views

How to allow users to connect from multiple devices with refresh tokens?

This question follows my previous one: How to securely keep my users signed in with refresh tokens? What I got from this previous question, is that we need: short-lived access tokens long-lived one-...
1
vote
0answers
286 views

Is access token saved in Cache.db-wal bad for iOS app?

tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
0
votes
4answers
2k views

How random token protect against CSRF

Generally we know that a random token added to each request is a good solution against CSRF. But how exactely is it work? The web server generates token, sends it to client in hidden form, than this ...
8
votes
6answers
2k views

Protect PHP hashing algorithm (from bots)

First of all, I'm new to this whole crypto thing. Here's my scenario: I have a client app, that sends a 20char max string to my server. The server then checks if the name is indeed matching the char ...
1
vote
1answer
818 views

Can an SSL certificate be used to generate a SAML token

An external application (B) requires a SAML token to allow users who log into my application (A) to access it directly without having to log in again. This access is not built yet. My organization has ...
1
vote
1answer
501 views

Is refresh token nessesary with HTTPS

I fully understand the benefits of refresh token in the case that Access Token gets compromised. I send JWT access token to the server only through HTTPS for a mobile application and web application ...
2
votes
1answer
839 views

What's the state-of-the-art approach to secure a backend API?

Scope Currently we are developing a backend REST API which is consumed by handful of MVC applications. In this case we are talking only about server-server communication and the API won't be consumed ...
2
votes
2answers
178 views

Token generation and random numbers

I have a swift server, where currently authentication is handled through a simple email+hashed password combination. I want to replace this with an access token ( + expiration ) so I can remove the ...