Questions tagged [token]

DO NOT USE THIS TAG! For questions about CSRF-tokens, use [CSRF]. For questions about session IDs, use [session-management]. For questions about OAuth tokens, use [oauth] and [oauth2]. For questions hardware authentication tokens, use [hardware-token].

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Is it normal for a 3rd party websites to store github access token in their database?

As github allows the request of tokens for 3rd party websites to access the user's github repositories. Is it common practice for 3rd party websites to store github access token in their database?
0
votes
1answer
44 views

What should I worry about when attaching a token to a request manually?

I'm developing a platform that has 2 parts: An API written using Laravel, that integrates with the database and provided data in a restful state. Multiple fronts that connect to the API and perform ...
0
votes
1answer
66 views

Github.com token authorisation since 13th August, impractical?

Gihub removed password authentication: remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information. fatal: unable to access 'https://...
3
votes
2answers
157 views

What is the point of signing a JWT with a JWK if you need to communicate with the token issuer?

If I understand correctly, a JSON Web Token (JWT) can be asymmetrically signed with a special private key (JWK). At least in some common configurations, the public part of the signing key can't be ...
2
votes
1answer
49 views

Frontend authenticates in server using jwt token issued by another server

I have two servers and frontend client: one server authorize and authenticate user, after that issue jwt token to client. Frontend client also visits second backend server using jwt token as ...
0
votes
0answers
39 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
0
votes
1answer
61 views

CSRF tokens in file that we can upload a file

I am dealing with a website vulnerable to CSRF. Let's say that the page (upload.php) has the following code if (isset($file_submit)) { //submit_file() } else { show_submission_form() } ...
0
votes
0answers
48 views

Secure connection between two applications on different systems

I have two applications that are running in different servers, the first one is an admin web application that has a client mobile version, and the second one is just a python process that manages ...
0
votes
3answers
96 views

How many bytes for password reset token? Should one take steps to hash or conceal raw CSPRNG bytes?

I'm trying to follow the OWASP 'Forgot Password Cheat Sheet' recommendations for password reset functionality via email. This requires my server to generate a token. OWASP says that PHP's random_bytes(...
1
vote
1answer
81 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
2
votes
2answers
55 views

Check Expired Token (after a visit)

I'm implementing a model which I'll have to reupdate the users, so I want to deliver a unique link to the users and after confirmed the update, I expire that link, so I prevent reusing that link. How ...
1
vote
0answers
90 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
1
vote
1answer
40 views

Kubernetes bootstrap token with no expiration

I would like to know the security implications of using a bootstrap token that never expires. The reason why I'm considering doing that is that I'm using terraform and my control-plane is in a ...
1
vote
1answer
214 views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
1
vote
0answers
43 views

mORMot 1.18 doesn't invalidate session_signature after logout? is this the default behaviour?

On a website which uses mORMot 1.18 every request made by an authenticated user is in this format: ../search_items?session_signature=0000004C000F6DD02E24541C as reported within the framework docs ...
0
votes
1answer
117 views

How to securely store and use session IDs

I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each). Given that the session ID is generated with enough entropy and that the session ID is then ...
1
vote
1answer
120 views

How do I maintain/check a user session in the backend without having to use tokens?

I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session. I have searched some solutions but I couldn't find any answer for my problem/...
2
votes
1answer
146 views

When to request refresh token? JWT

I am trying to implement JWT in a secure way in Node.js and I am unsure when to request the refresh token. I got one access token and one refresh token. Both are saved in two httpOnly cookies. When ...
1
vote
1answer
52 views

What happens if a secure token is provided to a trusted party that gets compromised

Take for example - AWS STS token or JWT tokens. Let’s say node A got a token for accessing a resource of account X on behalf of account X. Access includes read/write privileges. Let’s say few minutes ...
1
vote
0answers
152 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
0
votes
1answer
88 views

Generating tokens via PRNG and Hashing

We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it Step 1: Generate a random number using a good a CSPRNG ...
0
votes
0answers
73 views

Do JWT refresh tokens have security benefits?

I'm trying to figure out where the security benefits of having a refresh token and an access token for JWT are. Another post on stackexchange says: But why is it safe to have a refresh token that can ...
0
votes
0answers
43 views

OWASP session token in url azure b2c

Crawling and auditing the traffic using the Burp Suite, our Angular application was flagged for the following: OWASP Top 10 Classification - Broken authentication and session management - Sensitive ...
2
votes
1answer
181 views

What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?

From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
3
votes
0answers
203 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
1answer
63 views

token _csrf in an url POST

I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
1
vote
2answers
326 views

Cross-Domain Request is a CSRF Attack? (CORS)

CORS is a HTTP Suite header that “relax” the SOP. One of the CORS misconfigurations is about to reflect without reg exp the “Origin” client header into “ACAO” response header. If it happens with “ACAC:...
1
vote
1answer
251 views

Why is ID token used instead of Access token to get temporary credentials in AWS?

After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc.. From all standards - ID token should not be used to gain access ...
0
votes
0answers
39 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
1
vote
2answers
645 views

Sending token through GET vs POST

Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server. There are two options: Sending token through Headers as part of HTTP GET ...
0
votes
1answer
74 views

Using Refresh Token inside of Access Token without HTTPS

I previously read that Access Token must be sent with every request to the API but Refresh Token must be sent ONLY when the Access Token expires. I'm trying to use a similar model to the conventional ...
0
votes
2answers
128 views

Saving authorization token in browser [duplicate]

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
16
votes
3answers
4k views

Am I generating email link tokens correctly?

I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...). There are ...
0
votes
3answers
304 views

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this: { "username": "lukas", "isAdmin": true } The ...
1
vote
1answer
57 views

What is the proper way to sign up a user with a REST API?

I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain (user@example.com). I have a working API written in ...
0
votes
1answer
308 views

Token and cookie based mechanisms: stateful or stateless, session or nonsession based?

Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some ...
0
votes
0answers
178 views

Firebase token storage on logout

We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity ...
1
vote
0answers
258 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
0
votes
1answer
42 views

Understanding patch for my report

I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on I still want to try and bypass things but I don't ...
2
votes
0answers
63 views

Passing 3rd Party Access Token in redirection URL of 3rd Party Website

I am integrating a website with 3rd party API. The 3rd party site allows me to generate Access Token by using Client Key/Client Secret. In one of the pages, I need to redirect to 3rd party site 's ...
-1
votes
1answer
79 views

Passing data from Mobile APP (Android / iOS) to the web UI of the application

We want token of the user generated in Mobile App SignIn to be transferred to the WebUI what would be the better approach for sharing confidential data to the WebUI. Do we follow something like https:...
0
votes
1answer
92 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
4
votes
1answer
161 views

Does the browser get the access_token in OAuth2?

I've spent more than 10 days trying to understand the Authorization Code Flow for a web application where I'm supposed to implement OpenID Connect for a single sign on. It feels that there is a lot of ...
3
votes
0answers
80 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
1
vote
1answer
305 views

Do you really need an access token and refresh token?

When using a single page application, in what way is access token + refresh token more secure than a single token in a cookie with SameSite: strict. Given the browser supports SameSite. I completely ...
1
vote
1answer
104 views

How do I automatically add a user login token to my csrf page?

I'm testing my own system, and I was wondering if the csrf login token I created there could be obtained from the user session. For example; <input type="hidden" name="login&#95;token" value="...
1
vote
1answer
186 views

Double Submit Cookie: Can the attacker set the cookie as a separate header?

I’m using an HttpOnly cookie to store authentication token client-side. To mitigate some of the risks of CSRF attacks, I’m employing the Double Submit Cookie pattern. The same token is saved client-...
3
votes
2answers
947 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
2
votes
0answers
174 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
32
votes
3answers
4k views

Should I be able to see patterns in a HS256 encoded JWT?

I was fiddling with https://jwt.io/ using this header { "alg": "HS256", "typ": "JWT" } when I realized that replacing the payload name with something repetitive like AAAAAAAAAAAAAAAAAAAA would ...

1
2 3 4 5