
Perishable token should be stored encrypted in the database
Reported by Lawrence Pit | May 27th, 2009 @ 06:47 PM
I think a perishable token should be handled just like any other password. In other words, a perishable token should be stored in an encrypted form in the database, not in clear text.
Comments and changes to this ticket
-
Ben Johnson May 28th, 2009 @ 03:49 AM
- State changed from new to open
Hi Lawrence, how would you store the perishable token in the cookie? Encrypted I suppose. So what are you trying to accomplish? Because now we are just passing encrypted strings back and forth. I guess you could give them the plain token for their cookie, but how do I get that? I would need to use a reversible encrypting algorithm which I'd like to avoid.
Also, the perishable tokens are a result of passing random tokens to the Sha512 hashing algorithm.
-
Ben Johnson June 3rd, 2009 @ 03:49 AM
Well the perishable token is perishable, it defaults to 10 minutes. So if someone did get the token they would have 10 minutes to use it. Also, It is also constantly being changed. In fact, it is being changed in a before_save hook.
The only thing I can think to do is provide an alternate method that generates a new friendly token, encrypts it, and then saves it to the db. This will break backwards compatibility though. I need to give this some thought and make sure I do this properly.
-
Ben Johnson June 20th, 2009 @ 04:42 AM
- State changed from open to hold
-
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
Object based authentication solution that handles all of the non sense for you. It's as easy as ActiveRecord is with a database.