Hot answers tagged

298 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. ...
Vegard's user avatar
  • 3,182
63 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the ...
bbsimonbb's user avatar
  • 969
51 votes

Am I generating email link tokens correctly?

If you are storing all the relevant information (token, expiration time, user) in the database anyway, the only thing you need to make sure about the token is that it is impossible to guess a token. ...
Anders's user avatar
  • 65.5k
49 votes

Should I be able to see patterns in a HS256 encoded JWT?

tl/dr: Your selected version of the JWT doesn't encrypt anything, it merely encodes it for easy transport. The data in the payload is not meant to be a secret. You have a JWS (JWT with signature). ...
Conor Mancone's user avatar
27 votes
Accepted

Should I be able to see patterns in a HS256 encoded JWT?

There's a bit of confusion of terminology here. JWT defines the basic format of the claims, and some standard claims. It specifies that the JWT Claims Set should either be the payload of a JWS or a ...
Bob's user avatar
  • 1,208
22 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

The word Bearer wants to provide the authentication scheme. since there are Different Authentication Schemes provided with the Authorization header like: Basic use for http-basic-Authentication ...
Abilogos's user avatar
  • 321
19 votes

Why are generated access tokens for APIs much longer than passwords?

Quite simply, the token is not designed to be memorized so it can be as long as they want. A password is limited in length to what a person can practically reliably recall after a short memorization ...
Jeff Meden's user avatar
  • 3,976
16 votes

Protect PHP hashing algorithm (from bots)

You cannot. It is unfortunate, but you cannot. Whatever is running as the client (barring some situations you are almost certainly not in involving TPM) can, if someone is sufficiently motivated, be ...
crovers's user avatar
  • 6,381
14 votes

Should I be able to see patterns in a HS256 encoded JWT?

What you're missing is that your token is signed (or, more precisely, authenticated with a symmetric key) but not encrypted. If you take the token in your question above, split it into three pieces ...
Ilmari Karonen's user avatar
13 votes
Accepted

Why are generated access tokens for APIs much longer than passwords?

There are several reasons for that. One reason is that memorable passwords are too short for the expected security level. Several methods are used to mitigate this problem, but it would be ...
Gilles 'SO- stop being evil''s user avatar
12 votes
Accepted

How to allow users to connect from multiple devices with refresh tokens?

In my opinion the question you're asking now is not really regarding security anymore, instead it's more focused on the implementation of a concept. You have already established that refresh tokens ...
Joe's user avatar
  • 1,224
11 votes
Accepted

How to store the access token / password reset token in the database?

Since you know that your plaintext tokens are unique (or at least this is a logical inference) you don't need a salt. The salt's intention is solely to provide hash-uniqueness in the case of identical ...
Polynomial's user avatar
  • 135k
11 votes
Accepted

Would encrypting a signed JWT prove viable to secure claims payload?

I believe you are asking two questions: does changing payload invalidate signature: TL;DR: yes does adding encryption over JWT give you authenticity of content: TL;DR: don't encrypt yourself, use ...
channel's user avatar
  • 401
11 votes

Protect PHP hashing algorithm (from bots)

HashCash You could incorporate proof of work into the system: use something like HashCash to require the user to spend, say, 1 second of CPU-time to message your server. This system could be as ...
QuadmasterXLII's user avatar
11 votes

How to allow users to connect from multiple devices with refresh tokens?

I agree with Joe's answer A possible solution is to add a device identification field in your database and issue a refresh token per device. but I'd like to add some implementation details. IMO ...
DmitriyS's user avatar
  • 111
9 votes

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

A Bearer Token is set in the Authorization header of every Inline Action HTTP Request and Bearer itself determines the type of authentication. Ref https://developers.google.com/gmail/markup/actions/...
Yasser Gersy's user avatar
9 votes

Why do big sites use cookies and not OpenID connect?

Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them. To answer the closest ...
CBHacking's user avatar
  • 47.6k
8 votes

Why refresh tokens are used

I'm assuming you are using some proprietary authentication solution, which is using JWT and refresh tokens but has nothing to do with OpenID Connect. JWT tokens are stateless, refresh tokens are ...
Vilmantas Baranauskas's user avatar
8 votes

Protect PHP hashing algorithm (from bots)

Rate limiting, plain and simple. You need to determine just how important the service is. If it's a service that your application depends on, it needs to have security implemented. It could take the ...
zzarzzur's user avatar
  • 1,132
8 votes
Accepted

Does the TOTP Algorithm rely on the client time always being synced correctly?

Does the TOTP Algorithm rely on the client time always being synced correctly? Yes What happens if for some reason a cell phones clock / calendar is off by a significant amount of time? Does the ...
Ángel's user avatar
  • 18.8k
7 votes
Accepted

How is github 2FA personal access token more secure than passphrase?

The security lies in that you have a unique "access token" per client. So you can revoke and control as you will. Look at for example, Googles "App Passwords" which are the same thing. These tokens, ...
sebastian nielsen's user avatar
7 votes

How does JTI prevent a JWT from being replayed?

Great question. I think the RFC text is a little confusing. If the JWT is intercepted in some API call, this token can of course be used again and again (unless the application creates one-time-use ...
Jeff's user avatar
  • 71
7 votes

Does the TOTP Algorithm rely on the client time always being synced correctly?

It is a common misconception that the TOTP algorithm is anyhow involved with Google or the other way round. TOTP is based on the HOTP algorithm, that was published in 2005 in RFC 4226. The TOTP ...
cornelinux's user avatar
  • 2,053
6 votes

Secure HttpOnly Cookie or Header field for auth token securing an API?

I don't think there is a big difference in security between cookies or headers, if properly used. Cookies are meant to maintain server state. So if you have a login call which starts a session, ...
Sjoerd's user avatar
  • 30.4k
6 votes
Accepted

How to generate random but unique tokens for authentication?

Using os.urandom() is perfectly alright. It generates a cryptographically secure random stream of bytes. This would be impossible to guess for anyone. Using guid() is also pretty secure, although not ...
Sjoerd's user avatar
  • 30.4k
6 votes

How does JTI prevent a JWT from being replayed?

How does a JTI prevent a JWT from being replayed? How often should the JTI field be regenerated? On every request? or only when a new token is generated? I believe the answers to these two ...
SilverlightFox's user avatar
6 votes

Is an 8 characters long password reset token strong enough?

all the tokens had 8 characters, all alphabetes capital and small, no numbers or special characters This is on the edge of acceptable. It isn't easy to compromise an account this way. In an online ...
Sjoerd's user avatar
  • 30.4k
5 votes
Accepted

Access via link in Email - How can I make this most secure?

Is the added security the 2nd option delivers worth the longer process, in your opinion? I know this is a subjective question, but your opinion means a lot to me. You correctly saw the security it ...
WhiteWinterWolf's user avatar
5 votes
Accepted

Security requirements for one time access code/token in the url

That's certainly a reasonable approach. I would, as you suggest in your post, limit it both to a token that is both time-bound and one-time-use. How long it needs to be depends on how much entropy ...
Xander's user avatar
  • 35.8k
5 votes

What's the minimum access code length considered secure?

It depends on how this code is entered, if this is a type a code in a box from a computer keyboard or a type a code on a physical keypad that requires a user to physically brute force it. If it has ...
iainpb's user avatar
  • 4,172

Only top scored, non community-wiki answers of a minimum length are eligible