#113 ✓hold
Lawrence Pit

Perishable token should be stored encrypted in the database

Reported by Lawrence Pit | May 27th, 2009 @ 06:47 PM

I think a perishable token should be handled just like any other password. In other words, a perishable token should be stored in an encrypted form in the database, not in clear text.

Comments and changes to this ticket

  • Ben Johnson

    Ben Johnson May 28th, 2009 @ 03:49 AM

    • State changed from “new” to “open”

    Hi Lawrence, how would you store the perishable token in the cookie? Encrypted I suppose. So what are you trying to accomplish? Because now we are just passing encrypted strings back and forth. I guess you could give them the plain token for their cookie, but how do I get that? I would need to use a reversible encrypting algorithm which I'd like to avoid.

    Also, the perishable tokens are a result of passing random tokens to the Sha512 hashing algorithm.

  • Lawrence Pit

    Lawrence Pit May 28th, 2009 @ 04:42 AM

    When a user requests a new password an email is send with a link containing the perishable token. This token is like sending a plain-text password.

    Therefor it MUST be hashed in the database.

    I.e.: send the plain-text perishable token in the email, hash the token, save the hash in the database and throw away the original from memory.

    The same is true for the persistence token btw. As it's send around via a cookie it too should be hashed in the database.

  • Ben Johnson

    Ben Johnson June 3rd, 2009 @ 03:49 AM

    Well the perishable token is perishable, it defaults to 10 minutes. So if someone did get the token they would have 10 minutes to use it. Also, It is also constantly being changed. In fact, it is being changed in a before_save hook.

    The only thing I can think to do is provide an alternate method that generates a new friendly token, encrypts it, and then saves it to the db. This will break backwards compatibility though. I need to give this some thought and make sure I do this properly.

  • Ben Johnson

    Ben Johnson June 20th, 2009 @ 04:42 AM

    • State changed from “open” to “hold”
  • AMSA2018
  • sdasfdf

    sdasfdf October 7th, 2018 @ 01:05 PM

    Thanks for sharing.I found a lot of interesting information here. A really good post, very thankful and hopeful that you will write many more posts like this one.

  • Julie464

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Object based authentication solution that handles all of the non sense for you. It's as easy as ActiveRecord is with a database.

People watching this ticket