Skip to main content
Share Your Experience: Take the 2024 Developer Survey
208 votes
Accepted

Are private, unguessable URLs equivalent to password-based authentication?

A private URL is somewhat weaker than authentication with credentials, even if the bit size of the URL is the same as that of the credentials. The reason is the URL may more easily "leak". It is ...
JacquesB's user avatar
  • 59.7k
59 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

This is a really good example of insecure authentication, justified on the basis that if the site is compromised it is not possible to identify the person. If that's the case, why do we even need a ...
Michael Shaw's user avatar
  • 9,955
51 votes
Accepted

Cookie-based vs Session vs Token-based vs Claims-based authentications

I agree that the naming of the different concepts is confusing. When talking about authentication in a web context, there are several aspects to consider. What information does the client send when ...
TheFogger's user avatar
  • 828
48 votes

Are private, unguessable URLs equivalent to password-based authentication?

Note: A lot of people seem to be confusing a "private" URL with authentication. Also, there seems to be some confusion that sending the link via a trusted entity is an attempt at two-factor ...
Charles D Pantoga's user avatar
30 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

"Never store passwords in plain text" is not a rule. It is a best practice based on common security breaches on naive implementations of password protections. In that sense, the question: Is this ...
ianmandarini's user avatar
  • 2,818
25 votes

Authentication and authorisation for people with intellectual disabilities

Users don't care. Mental disorder or not users simply don't care as much as you do about security. You could set up two factor, OTP, even physical keys and users will still wander off to the bathroom ...
candied_orange's user avatar
23 votes
Accepted

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

Be consistent Some may say this is unnecessary (and not too long ago I would have agreed) but these days, with so many auth protocols, if we use the Authorization header to pass an API key, it is ...
Laiv's user avatar
  • 14.7k
23 votes
Accepted

Is it bad practice to store a user's email address in a JWT?

Yes, it is bad practice and a security problem. Email addresses are PII (personally identifiable information). Like all other PII, email addresses should never be stored unencrypted at rest; doing so ...
alexwebb2's user avatar
  • 345
22 votes
Accepted

Handling token renewal / session expiration in a RESTful API

This sounds like a case of authentication versus authorization. JWTs are cryptographically signed claims about the originator of a request. A JWT might contain claims like "This request is for user X"...
Jack's user avatar
  • 4,489
21 votes
Accepted

Authorization and authentication system for microservices and consumers

Authentication and authorization are always good topics I will try to explain to you how we deal with authorizations in the current multi-tenant service that I am working. The authentication and ...
José María's user avatar
20 votes
Accepted

Difference between 'aud' and 'iss' in jwt

These are intended for scenarios where you have a token issuing authority that is not the same as the application that is the intended recipient. This may not be different for your application. But ...
Paul's user avatar
  • 3,317
19 votes
Accepted

Share private SSH keys with Bash on Windows

So as Telastyn commented I added symlinks in WSLs ~/.ssh/ to the id_rsa and id_rsa.pub using: > ln -s /mnt/c/Users/MyName/.ssh/id_rsa ~/.ssh/id_rsa > ln -s /mnt/c/Users/MyName/.ssh/id_rsa.pub ~/...
Toby's user avatar
  • 595
18 votes
Accepted

Caching authenticated requests for all users

I've been trying to address a similar issue. My users need to be authenticated for every request they make. I've been focusing on getting the users authenticated at least once by the backend app (...
mbarthelemy's user avatar
17 votes

Handling token renewal / session expiration in a RESTful API

Your API session is a thing which should not exist in a RESTful world at all. RESTful operations are supposed to be stateless, session contains state and thus has no place in a RESTful world. The JWT ...
Andy's user avatar
  • 10.3k
17 votes

Is it bad practice to store a user's email address in a JWT?

The short answer is no. There should not be any problem because email is a valid and registered public claim. I have a user DB where each user's unique ID is their email ... Well, there's a ...
Laiv's user avatar
  • 14.7k
17 votes

Authentication and authorisation for people with intellectual disabilities

Two obvious things. One, there's an inadequate specification of who the security measures need to resist, and/or who stands to gain from unauthorised access. No system is wholly resistant to ...
Steve's user avatar
  • 8,939
16 votes
Accepted

Group set of commands as atomic transactions (C++)

In practice, such atomic transactions do not exist. Instead, you can try to make all operations idempotent so that they can be safely retried. Idempotence is particularly important for network ...
amon's user avatar
  • 134k
15 votes

Share private SSH keys with Bash on Windows

Based on the new build "Insider Build 17063" permissions for files works differently now. In short you need to do: sudo umount /mnt/c sudo mount -t drvfs C: /mnt/c -o metadata This will make ...
Entity Black's user avatar
14 votes

Synonym for "Authorization"?

Using another word for "Authorization" or "Authentication" isn't helpful for writing documentation. Even though they're obscure, these two are already the most common words for those things, and any ...
Kilian Foth's user avatar
12 votes
Accepted

cookie vs. session vs jwt

Cookies: in their early version, a text file with a unique client Id an all the other information needed about the client (e. g. roles) Cookies are tuples key-value originally addressed to retain ...
Laiv's user avatar
  • 14.7k
11 votes
Accepted

Should I encrypt mobile number and otp when sending to backend

What my concern is someone can figure out the API, and start hitting with different combination of OTPs for mobile number and gain the access to an account This is a frequent question related to ...
Laiv's user avatar
  • 14.7k
11 votes
Accepted

Microservice Architecture - using Auth Server as a User Resource server

3 is the correct answer. Your Auth server authenticates users, Your User server would perhaps be better named 'UserProfiles' You'll find that many of your users will be people with profiles, but ...
Ewan's user avatar
  • 76.3k
10 votes
Accepted

Should access permissions and roles be included in payload of JWT?

The purpose of including claims in the token is so you don't have to have that communication between the resource and the authentication provider. The resource can just check that the token has a ...
Ewan's user avatar
  • 76.3k
10 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

In Short: No If you forget your password, you ask the professor, who can look it up I see no real reason in the question to ignore the secure authentification guidelines here. Many (too many) ...
Kaddath's user avatar
  • 200
9 votes
Accepted

is "ASP.NET Membership" still a good choice for ASP.NET MVC authentication nowdays?

Yes. Asp.Net Membership is a bit outdated. Asp.Net Identity was introduced a few years ago to help solve some of the pain points with the older system. It supports third party OAuth through Google (...
RubberDuck's user avatar
  • 8,961
9 votes
Accepted

Is it bad to leave Azure secrets keys as plaintext in my source code if I don't release the code, only the exe?

Yes, anyone can easily find the key. The simplest method would be to use the .net development tools (available for free download from Microsoft) which contains a decompiler. Aim the decompiler at the ...
Kain0_0's user avatar
  • 16.2k
8 votes

Are private, unguessable URLs equivalent to password-based authentication?

Pretty much all authentication schemes boil down to proving that you know a secret. You authenticate yourself to some service by proving that you know a secret password, or a secret URL or,... Some ...
Solomon Slow's user avatar
  • 1,213
8 votes
Accepted

Should arbitrary numbers be stored as strings in a database?

Store it as a string. You've already stated some of the reasons why: You're not going to do any mathematical operations on it You need a very large precision number to store that many digits Let me ...
Robert Harvey's user avatar
8 votes

cookie vs. session vs jwt

Cookies: in their early version, a text file with a unique client Id an all the other information needed about the client (e. g. roles) Your definition of cookie doesn't really describe what they do. ...
Samuel's user avatar
  • 9,197
8 votes
Accepted

Authentication and authorization - front-end vs back-end dilemma

The backend person might have omitted their valid justifications Back-end person claims that front-end should to have two calls. First to authenticate user (login process) with JWT response only ...
Flater's user avatar
  • 51.7k

Only top scored, non community-wiki answers of a minimum length are eligible