I'm looking for failures in this "token based login" design, besides the UML "syntax" errors. Theoretically speaking, it will do the trick when implemented on an small project.

If true, sorry about my english.

Thaks in advance.

EDIT: Is 1) this model something useful and clear? 2) Will it work when implemented? 3) Besides the implementation, is secure?

Token based authentication sequence diagrams

  • I am glad that you are looking for failures in your protocol. What is your question about this protocol? – Kain0_0 Jan 11 at 4:33
  • Kain0_0 thanks for commenting. I've edited the post adding some questions that concern me. – Marcelo Jan 12 at 16:53
  1. Useful and clear will depend on who you are communicating with and about what. This appears to be a reasonable diagram with which to discuss how authentication occurs in a particular application.

  2. Work when implemented? I'm not sure how good your team is about filling in the missing details surrounding this diagram. If they are good, the resulting code may be operational. Taking a guess, I believe you mean work as in achieve the intended function? That will depend on the specifics of what you consider functional. I find the User-Password path reasonable, I have questions about how the Token is being implemented.

  3. If you want security, throw this out and find a model deemed secure by the cryptographic/security community. As an aside you can dabble in this, but even seasoned professional security experts have trouble defining a secure system from the ground up. If this is going anywhere near a production environment do not make your own. Find and use tried and tested implementations, or at worst find tried and tested approaches, and have your implementation studied intensely for vulnerabilities.

My specific questions about your token system boil down to:

  • Why are you persisting the token locally? The point of a token is for it to be validatable without checking back with the authoriser.
  • Why are the password hashes being stored in the token? This is not a good idea.
  • How are you encrypting the token? This is important for security.
  • Have you considered how to defend the token against replay attacks? This is important to prevent fraud.
  • Have you looked at other token based architectures?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.