206 votes
Accepted

Are private, unguessable URLs equivalent to password-based authentication?

A private URL is somewhat weaker than authentication with credentials, even if the bit size of the URL is the same as that of the credentials. The reason is the URL may more easily "leak". It is ...
user avatar
  • 54.7k
60 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

This is a really good example of insecure authentication, justified on the basis that if the site is compromised it is not possible to identify the person. If that's the case, why do we even need a ...
user avatar
  • 9,865
50 votes
Accepted

Cookie-based vs Session vs Token-based vs Claims-based authentications

I agree that the naming of the different concepts is confusing. When talking about authentication in a web context, there are several aspects to consider. What information does the client send when ...
user avatar
  • 793
48 votes

Are private, unguessable URLs equivalent to password-based authentication?

Note: A lot of people seem to be confusing a "private" URL with authentication. Also, there seems to be some confusion that sending the link via a trusted entity is an attempt at two-factor ...
user avatar
33 votes
Accepted

JSON Web Token - why is the payload public?

You choose not to encrypt the payload for the same reasons that you choose not to encrypt anything else: the cost (however small it is) exceeds the benefit, and a lot of data simply doesn't need to be ...
user avatar
30 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

"Never store passwords in plain text" is not a rule. It is a best practice based on common security breaches on naive implementations of password protections. In that sense, the question: Is this ...
user avatar
  • 2,698
23 votes
Accepted

Custom use of Authorization header in a REST API

Using the Authorization header seems like the right thing to do. It's the entire purpose of the Authorization header. From https://www.rfc-editor.org/rfc/rfc7235#section-4.2 : The "Authorization&...
user avatar
23 votes
Accepted

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

Be consistent Some may say this is unnecessary (and not too long ago I would have agreed) but these days, with so many auth protocols, if we use the Authorization header to pass an API key, it is ...
user avatar
  • 11.7k
22 votes
Accepted

Handling token renewal / session expiration in a RESTful API

This sounds like a case of authentication versus authorization. JWTs are cryptographically signed claims about the originator of a request. A JWT might contain claims like "This request is for user X"...
user avatar
  • 4,389
20 votes
Accepted

Authorization and authentication system for microservices and consumers

Authentication and authorization are always good topics I will try to explain to you how we deal with authorizations in the current multi-tenant service that I am working. The authentication and ...
user avatar
19 votes
Accepted

Share private SSH keys with Bash on Windows

So as Telastyn commented I added symlinks in WSLs ~/.ssh/ to the id_rsa and id_rsa.pub using: > ln -s /mnt/c/Users/MyName/.ssh/id_rsa ~/.ssh/id_rsa > ln -s /mnt/c/Users/MyName/.ssh/id_rsa.pub ~/...
user avatar
  • 595
18 votes
Accepted

Difference between 'aud' and 'iss' in jwt

These are intended for scenarios where you have a token issuing authority that is not the same as the application that is the intended recipient. This may not be different for your application. But ...
user avatar
  • 3,257
17 votes

Handling token renewal / session expiration in a RESTful API

Your API session is a thing which should not exist in a RESTful world at all. RESTful operations are supposed to be stateless, session contains state and thus has no place in a RESTful world. The JWT ...
user avatar
  • 9,905
15 votes
Accepted

Caching authenticated requests for all users

I've been trying to address a similar issue. My users need to be authenticated for every request they make. I've been focusing on getting the users authenticated at least once by the backend app (...
user avatar
15 votes

Share private SSH keys with Bash on Windows

Based on the new build "Insider Build 17063" permissions for files works differently now. In short you need to do: sudo umount /mnt/c sudo mount -t drvfs C: /mnt/c -o metadata This will make ...
user avatar
15 votes
Accepted

Is it bad practice to store a user's email address in a JWT?

Yes, it is bad practice and a security problem. Email addresses are PII (personally identifiable information). Like all other PII, email addresses should never be stored unencrypted at rest; doing so ...
user avatar
  • 265
14 votes

Is it bad practice to store a user's email address in a JWT?

The short answer is no. There should not be any problem because email is a valid and registered public claim. I have a user DB where each user's unique ID is their email ... Well, there's a ...
user avatar
  • 11.7k
14 votes

Synonym for "Authorization"?

Using another word for "Authorization" or "Authentication" isn't helpful for writing documentation. Even though they're obscure, these two are already the most common words for those things, and any ...
user avatar
11 votes
Accepted

Should I specify the userId in the REST URL structure?

The first solution has a benefit of avoiding data duplication. The request plainly means: Hello, I'm John. Give me the list of my friends. If possible, I would even shorten it to GET /api/friends. ...
user avatar
11 votes
Accepted

Should I encrypt mobile number and otp when sending to backend

What my concern is someone can figure out the API, and start hitting with different combination of OTPs for mobile number and gain the access to an account This is a frequent question related to ...
user avatar
  • 11.7k
11 votes
Accepted

cookie vs. session vs jwt

Cookies: in their early version, a text file with a unique client Id an all the other information needed about the client (e. g. roles) Cookies are tuples key-value originally addressed to retain ...
user avatar
  • 11.7k
10 votes
Accepted

Should I store my user claims in the JWT token?

I store identifier claims only (userid, etc.) (encrypted) in my jwt. Then when I get the token on the server (API) I can do a lookup server side (db,redis, or local network api call) and retrieve all ...
user avatar
10 votes
Accepted

REST API security: HMAC/key hashing vs JWT

Let's get this started with a very basic answer. JWT (as used in the context of OAuth and OpenID) does not require shared secrets between client and API. There are 3 components and pairs of 2 share a ...
user avatar
  • 1,853
10 votes
Accepted

Should access permissions and roles be included in payload of JWT?

The purpose of including claims in the token is so you don't have to have that communication between the resource and the authentication provider. The resource can just check that the token has a ...
user avatar
  • 64.5k
10 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

In Short: No If you forget your password, you ask the professor, who can look it up I see no real reason in the question to ignore the secure authentification guidelines here. Many (too many) ...
user avatar
  • 201
9 votes
Accepted

is "ASP.NET Membership" still a good choice for ASP.NET MVC authentication nowdays?

Yes. Asp.Net Membership is a bit outdated. Asp.Net Identity was introduced a few years ago to help solve some of the pain points with the older system. It supports third party OAuth through Google (...
user avatar
  • 8,841
9 votes
Accepted

Is it bad to leave Azure secrets keys as plaintext in my source code if I don't release the code, only the exe?

Yes, anyone can easily find the key. The simplest method would be to use the .net development tools (available for free download from Microsoft) which contains a decompiler. Aim the decompiler at the ...
user avatar
  • 15.4k
8 votes
Accepted

Should arbitrary numbers be stored as strings in a database?

Store it as a string. You've already stated some of the reasons why: You're not going to do any mathematical operations on it You need a very large precision number to store that many digits Let me ...
user avatar
8 votes

Are private, unguessable URLs equivalent to password-based authentication?

Pretty much all authentication schemes boil down to proving that you know a secret. You authenticate yourself to some service by proving that you know a secret password, or a secret URL or,... Some ...
user avatar
  • 1,203
8 votes
Accepted

Microservice Architecture - using Auth Server as a User Resource server

3 is the correct answer. Your Auth server authenticates users, Your User server would perhaps be better named 'UserProfiles' You'll find that many of your users will be people with profiles, but ...
user avatar
  • 64.5k

Only top scored, non community-wiki answers of a minimum length are eligible