Hot answers tagged

283 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. ...
  • 3,032
132 votes
Accepted

Session Authentication vs Token Authentication

In Session-based Authentication the Server does all the heavy lifting server-side. Broadly speaking a client authenticates with its credentials and receives a session_id (which can be stored in a ...
  • 2,705
61 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the ...
  • 949
51 votes

Am I generating email link tokens correctly?

If you are storing all the relevant information (token, expiration time, user) in the database anyway, the only thing you need to make sure about the token is that it is impossible to guess a token. ...
  • 64.5k
49 votes

Should I be able to see patterns in a HS256 encoded JWT?

tl/dr: Your selected version of the JWT doesn't encrypt anything, it merely encodes it for easy transport. The data in the payload is not meant to be a secret. You have a JWS (JWT with signature). ...
47 votes
Accepted

How safe are employee laptops in China against International corporate espionage?

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. That may not have helped you at all. The reason I'm saying this ...
  • 22.5k
27 votes
Accepted

Should I be able to see patterns in a HS256 encoded JWT?

There's a bit of confusion of terminology here. JWT defines the basic format of the claims, and some standard claims. It specifies that the JWT Claims Set should either be the payload of a JWS or a ...
  • 1,188
23 votes

How safe are employee laptops in China against International corporate espionage?

Industrial espionage is unfortunately very common in China. There are cases where spyware was installed on computing devices (allegedly by hotel staff) and in some cases even hardware spying devices ...
  • 48.9k
20 votes
Accepted

What is a good way to authenticate a user to a smart phone?

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (...
  • 4,737
20 votes
Accepted

Is my JWT refresh plan secure?

Acceptably secure within the realm of what? You have described the basic flow for all bearer tokens. They who bear the token have the power. You do have a condition where you check if the token has ...
  • 15.2k
19 votes

Why are generated access tokens for APIs much longer than passwords?

Quite simply, the token is not designed to be memorized so it can be as long as they want. A password is limited in length to what a person can practically reliably recall after a short memorization ...
  • 3,966
17 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The word Bearer wants to provide the authorization scheme. since there are Different Authorization Schemes like: Basic use for http-basic-Authentication Digest MD5 hashed http-basic-authentication (...
  • 271
16 votes

Protect PHP hashing algorithm (from bots)

You cannot. It is unfortunate, but you cannot. Whatever is running as the client (barring some situations you are almost certainly not in involving TPM) can, if someone is sufficiently motivated, be ...
  • 6,321
15 votes

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

1. Where to authenticate the user? If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
  • 5,393
14 votes

What is a good way to authenticate a user to a smart phone?

You don't mention what sort of service it's for, but as a user the least irritating auth method on phones for me is SSO. I'm already signed into Google & Facebook anyway, so typically it's just a ...
  • 1,168
14 votes

Should I be able to see patterns in a HS256 encoded JWT?

What you're missing is that your token is signed (or, more precisely, authenticated with a symmetric key) but not encrypted. If you take the token in your question above, split it into three pieces ...
13 votes
Accepted

Why are generated access tokens for APIs much longer than passwords?

There are several reasons for that. One reason is that memorable passwords are too short for the expected security level. Several methods are used to mitigate this problem, but it would be ...
11 votes
Accepted

How to store the access token / password reset token in the database?

Since you know that your plaintext tokens are unique (or at least this is a logical inference) you don't need a salt. The salt's intention is solely to provide hash-uniqueness in the case of identical ...
  • 132k
11 votes
Accepted

Would encrypting a signed JWT prove viable to secure claims payload?

I believe you are asking two questions: does changing payload invalidate signature: TL;DR: yes does adding encryption over JWT give you authenticity of content: TL;DR: don't encrypt yourself, use ...
  • 381
11 votes

Protect PHP hashing algorithm (from bots)

HashCash You could incorporate proof of work into the system: use something like HashCash to require the user to spend, say, 1 second of CPU-time to message your server. This system could be as ...
11 votes
Accepted

How to allow users to connect from multiple devices with refresh tokens?

In my opinion the question you're asking now is not really regarding security anymore, instead it's more focused on the implementation of a concept. You have already established that refresh tokens ...
  • 1,214
10 votes

How to allow users to connect from multiple devices with refresh tokens?

I agree with Joe's answer A possible solution is to add a device identification field in your database and issue a refresh token per device. but I'd like to add some implementation details. IMO ...
  • 101
9 votes

Encrypted quiz data in PHP and JS

Your proposed mechanism is not secure. Anything available to JavaScript is available to the person running the client browser. Base64 encoding only mildly obscures the answers. Even encrypting them ...
  • 5,283
9 votes

Session Authentication vs Token Authentication

HTTP is stateless, and in order to have an authenticated state, you need some kind of token used to reference information about the user. This session id is usually in the form of a random token ...
  • 46.9k
9 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

A Bearer Token is set in the Authorization header of every Inline Action HTTP Request and Bearer itself determines the type of authentication. Ref https://developers.google.com/gmail/markup/actions/...
8 votes

Randomly generated token vs JSON web token

Either way is fine, it just depends whether you want authentication to be stateless. Advantages of JWTs: Stateless. Little or no database overhead. Individual back-end components can validate the ...
8 votes

Why refresh tokens are used

I'm assuming you are using some proprietary authentication solution, which is using JWT and refresh tokens but has nothing to do with OpenID Connect. JWT tokens are stateless, refresh tokens are ...
8 votes

Protect PHP hashing algorithm (from bots)

Rate limiting, plain and simple. You need to determine just how important the service is. If it's a service that your application depends on, it needs to have security implemented. It could take the ...
  • 1,112
7 votes
Accepted

What encoding could this be? Looks similar to base64

If it looks like base64 but isn't quite, it might be base64 with a custom alphabet. This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web ...
  • 72k
7 votes

Is CAPTCHA necessary when I use an anti-CSRF token?

Yes its neccessary. A token can still be requested by a bruteforcer. Yes, it would cost the bruteforcer one request extra per try, but a captcha still blocks attempts completely instead. If you dont ...

Only top scored, non community-wiki answers of a minimum length are eligible