CODEWITHSUNDEEP
securitywebcryptography
Ben G
Ben G

Reputation: 26789

Hash that only lasts a day for a given user

would this method of generating and checking a hash allow one to create secure user-specific hashes that would only last for a single day?

generate_token: sha(salt + day_of_year + user)

check_token: sha(salt + day_of_year + user) == get['token']

The idea here would be to create an instant-login token that could only last for a single day. It could be sent by email to individual users.

Upvotes: 0

Views: 39

Answers (1)

Amber
Amber

Reputation: 527378

A better way to do this would be to calculate an expiry timestamp (current time + 86400 seconds, for instance), and then store that timestamp in the database while also including it in the hash:

user | expiry | hash
-----+--------+--------------------------
...  | 123456 | sha(salt + 123456 + user)

Then when checking, you see if (a) the hash exists, and (b) it matches the user, and (c) the expiry timestamp hasn't already passed.

This gives you hashes that will always last a day from when they are issued, rather than just lasting until whenever the next day starts.

It also lets you easily prune out expired hashes from your database if you so desire, to keep the number of rows smaller.

Upvotes: 3

Related Questions