Simplest token-system for authenticating and authorizating

Question

I want to make Python script that will accept input from Vim and send it to my web-site. So basically I want to make Vim my text-editor for blog articles.

Of course, I need to authenticate and authorizate. I wanted to simply ask username and password. My college asked me why not to take login data from file. I answered that I don't want to save password in plain-text. He told me to use tokens!

So how to do it? I understand that I need to generate random token for user and knowing it will allow anyone to login. It should be really strong and random so nobody can guess it. Is there something else? Will it be safe to save it in text file?

I would like to hear how would you implement it in the simplest possible yet secure way. Some links to literature would be good too!

Answer 1

I understand that you are the only person (or one of very few) to use this mechanism:

if you want to authenticate other users of your webapp, then refer to @Martin's answer, otherwise:

your token is technically called a shared secret. It works and it is secure (as long as the secret is not shared to the outside world, like e.g. readable from the web, etc.).
saving it in a text-file is secure if the storage is secure.

another very simple way would be basic auth. it should be sent over ssl, though. see this question for some further discussion on its security implications.

Answer 2

Although you still need a way to authenticate your user the first time (against a hashed password) you can then set a secure cookie that will prove your user is the same one still.

To do this securely, you need a server-side secret, and cookie values that have the time of creation, the username, and that secret hashed together, so that when your user returns for the next HTTP connection you can a) retrieve the username, and b) verify the cookie is still valid and secure.

This is what the mod_auth_tkt Apache module implements, as well as the Pyramid AuthTktAuthenticationPolicy class and the plone.app.session package.

You could take a look through the source code of the latter two to see what they do to create and verify these cookies:

• plone.app.session code; the tktauth module does most of the work here.

• AuthTktAuthenticationPolicy code; I linked directly to the AuthTktCookieHelper class that does the heavy lifting for the cookie; I explained some of the fields the policy takes before:

  • https://stackoverflow.com/questions/12232364/pyramid-security-questions-double-cookies-insecure-cookies-expiration/12234593#12234593
  • https://stackoverflow.com/questions/12765349/pyramid-authtktauthenticationpolicy-secret-parameter