Perishable token should be stored encrypted in the database
Reported by Lawrence Pit | May 27th, 2009 @ 06:47 PM
I think a perishable token should be handled just like any other password. In other words, a perishable token should be stored in an encrypted form in the database, not in clear text.
Comments and changes to this ticket
-
Ben Johnson May 28th, 2009 @ 03:49 AM
- State changed from “new” to “open”
Hi Lawrence, how would you store the perishable token in the cookie? Encrypted I suppose. So what are you trying to accomplish? Because now we are just passing encrypted strings back and forth. I guess you could give them the plain token for their cookie, but how do I get that? I would need to use a reversible encrypting algorithm which I'd like to avoid.
Also, the perishable tokens are a result of passing random tokens to the Sha512 hashing algorithm.
-
Lawrence Pit May 28th, 2009 @ 04:42 AM
When a user requests a new password an email is send with a link containing the perishable token. This token is like sending a plain-text password.
Therefor it MUST be hashed in the database.
I.e.: send the plain-text perishable token in the email, hash the token, save the hash in the database and throw away the original from memory.
The same is true for the persistence token btw. As it's send around via a cookie it too should be hashed in the database.
-
Ben Johnson June 3rd, 2009 @ 03:49 AM
Well the perishable token is perishable, it defaults to 10 minutes. So if someone did get the token they would have 10 minutes to use it. Also, It is also constantly being changed. In fact, it is being changed in a before_save hook.
The only thing I can think to do is provide an alternate method that generates a new friendly token, encrypts it, and then saves it to the db. This will break backwards compatibility though. I need to give this some thought and make sure I do this properly.
-
Ben Johnson June 20th, 2009 @ 04:42 AM
- State changed from “open” to “hold”
-
-
sdasfdf October 7th, 2018 @ 01:05 PM
Thanks for sharing.I found a lot of interesting information here. A really good post, very thankful and hopeful that you will write many more posts like this one.
https://kodi.software/
https://plex.software/
https://luckypatcher.pro/ -
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create new ticket
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
Object based authentication solution that handles all of the non sense for you. It's as easy as ActiveRecord is with a database.
Ben Johnson
Lawrence Pit