Skip to main content
51 votes

Am I generating email link tokens correctly?

If you are storing all the relevant information (token, expiration time, user) in the database anyway, the only thing you need to make sure about the token is that it is impossible to guess a token. ...
Anders's user avatar
  • 65.7k
49 votes

Should I be able to see patterns in a HS256 encoded JWT?

tl/dr: Your selected version of the JWT doesn't encrypt anything, it merely encodes it for easy transport. The data in the payload is not meant to be a secret. You have a JWS (JWT with signature). ...
Conor Mancone's user avatar
27 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The word Bearer wants to provide the authentication scheme. since there are Different Authentication Schemes provided with the Authorization header like: Basic use for http-basic-Authentication ...
Abilogos's user avatar
  • 371
27 votes
Accepted

Should I be able to see patterns in a HS256 encoded JWT?

There's a bit of confusion of terminology here. JWT defines the basic format of the claims, and some standard claims. It specifies that the JWT Claims Set should either be the payload of a JWS or a ...
Bob's user avatar
  • 1,208
19 votes

Why are generated access tokens for APIs much longer than passwords?

Quite simply, the token is not designed to be memorized so it can be as long as they want. A password is limited in length to what a person can practically reliably recall after a short memorization ...
Jeff Meden's user avatar
  • 3,976
16 votes

Protect PHP hashing algorithm (from bots)

You cannot. It is unfortunate, but you cannot. Whatever is running as the client (barring some situations you are almost certainly not in involving TPM) can, if someone is sufficiently motivated, be ...
crovers's user avatar
  • 6,381
14 votes

Should I be able to see patterns in a HS256 encoded JWT?

What you're missing is that your token is signed (or, more precisely, authenticated with a symmetric key) but not encrypted. If you take the token in your question above, split it into three pieces ...
Ilmari Karonen's user avatar
13 votes
Accepted

Why are generated access tokens for APIs much longer than passwords?

There are several reasons for that. One reason is that memorable passwords are too short for the expected security level. Several methods are used to mitigate this problem, but it would be ...
Gilles 'SO- stop being evil''s user avatar
12 votes
Accepted

How to allow users to connect from multiple devices with refresh tokens?

In my opinion the question you're asking now is not really regarding security anymore, instead it's more focused on the implementation of a concept. You have already established that refresh tokens ...
Joe's user avatar
  • 1,224
11 votes
Accepted

Would encrypting a signed JWT prove viable to secure claims payload?

I believe you are asking two questions: does changing payload invalidate signature: TL;DR: yes does adding encryption over JWT give you authenticity of content: TL;DR: don't encrypt yourself, use ...
channel's user avatar
  • 401
11 votes
Accepted

How to store the access token / password reset token in the database?

Since you know that your plaintext tokens are unique (or at least this is a logical inference) you don't need a salt. The salt's intention is solely to provide hash-uniqueness in the case of identical ...
Polynomial's user avatar
  • 135k
11 votes

Protect PHP hashing algorithm (from bots)

HashCash You could incorporate proof of work into the system: use something like HashCash to require the user to spend, say, 1 second of CPU-time to message your server. This system could be as ...
QuadmasterXLII's user avatar
11 votes

How to allow users to connect from multiple devices with refresh tokens?

I agree with Joe's answer A possible solution is to add a device identification field in your database and issue a refresh token per device. but I'd like to add some implementation details. IMO ...
DmitriyS's user avatar
  • 111
11 votes

Why do big sites use cookies and not OpenID connect?

Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them. To answer the closest ...
CBHacking's user avatar
  • 49.7k
9 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

A Bearer Token is set in the Authorization header of every Inline Action HTTP Request and Bearer itself determines the type of authentication. Ref https://developers.google.com/gmail/markup/actions/...
Yasser Gersy's user avatar
8 votes

Protect PHP hashing algorithm (from bots)

Rate limiting, plain and simple. You need to determine just how important the service is. If it's a service that your application depends on, it needs to have security implemented. It could take the ...
zzarzzur's user avatar
  • 1,132
8 votes
Accepted

Does the TOTP Algorithm rely on the client time always being synced correctly?

Does the TOTP Algorithm rely on the client time always being synced correctly? Yes What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the ...
Ángel's user avatar
  • 19k
7 votes
Accepted

How is github 2FA personal access token more secure than passphrase?

The security lies in that you have a unique "access token" per client. So you can revoke and control as you will. Look at for example, Googles "App Passwords" which are the same thing. These tokens, ...
sebastian nielsen's user avatar
7 votes

How does JTI prevent a JWT from being replayed?

Great question. I think the RFC text is a little confusing. If the JWT is intercepted in some API call, this token can of course be used again and again (unless the application creates one-time-use ...
Jeff's user avatar
  • 71
7 votes

Does the TOTP Algorithm rely on the client time always being synced correctly?

It is a common misconception that the TOTP algorithm is anyhow involved with Google or the other way round. TOTP is based on the HOTP algorithm, that was published in 2005 in RFC 4226. The TOTP ...
cornelinux's user avatar
  • 2,093
6 votes

How does JTI prevent a JWT from being replayed?

How does a JTI prevent a JWT from being replayed? How often should the JTI field be regenerated? On every request? or only when a new token is generated? I believe the answers to these two ...
SilverlightFox's user avatar
6 votes

Secure HttpOnly Cookie or Header field for auth token securing an API?

I don't think there is a big difference in security between cookies or headers, if properly used. Cookies are meant to maintain server state. So if you have a login call which starts a session, ...
Sjoerd's user avatar
  • 31.8k
6 votes

Is an 8 characters long password reset token strong enough?

all the tokens had 8 characters, all alphabetes capital and small, no numbers or special characters This is on the edge of acceptable. It isn't easy to compromise an account this way. In an online ...
Sjoerd's user avatar
  • 31.8k
6 votes

How to securely store and use session IDs

Your second approach is the right one to take, with a few additional notes. There's no need for a separate ID token. Just hash the session token and pass the hash digest to the DB (e.g. SELECT * FROM ...
CBHacking's user avatar
  • 49.7k
5 votes

What's the minimum access code length considered secure?

It depends on how this code is entered, if this is a type a code in a box from a computer keyboard or a type a code on a physical keypad that requires a user to physically brute force it. If it has ...
iainpb's user avatar
  • 4,172
5 votes
Accepted

How is security risk of storing authentication token in localStorage compared with cookies?

A cookie marked httpOnly, as the name implies, cannot be accessed from javascript. So a 'conventional' web application using cookies is not vulnerable to naive XSS attacks if that flag is set (...
Affe's user avatar
  • 341
5 votes

Logging secrets in the user agent (browser)

I see no real problem with doing this in development environments. However, I am not sure I would do it in production for a number of reasons: Why log stuff to the console in production at all? It ...
Anders's user avatar
  • 65.7k
4 votes

Token-based authentication - what's a good token length?

An update for those that find this question since it ranks highly on Google. If appears from the current PHP documentation that openssl_random_pseudo_bytes can generate a cryptographically strong ...
Craig Jacobs's user avatar
4 votes
Accepted

Time Based Authentication Verification Token

I would suggest making t a reduced-precision timestamp instead, where you set the precision to be half of the wish precision. The reason for this, is to both avoid having to send more data than ...
sebastian nielsen's user avatar
4 votes

Protect PHP hashing algorithm (from bots)

Accepting only one submission per ip address is not a very effective solution - ip addresses are not statically tied to individuals. Device fingerprinting (particularly when combined with other ...
symcbean's user avatar
  • 18.7k

Only top scored, non community-wiki answers of a minimum length are eligible