CODEWITHSUNDEEP
authenticationtoken
BenM
BenM

Reputation: 4278

When using Token based authentication how should you handle multiple tokens/expiry

I'm reading/learning about token based authentication and I'm understanding it to a degree but the following questions have arisen.

If you log into site A you are given a token, this token will expire 24 hours after creating it.

You also visit Site B which calls an API from site A that allows you to give site B access to your information stored on site A. At this point a token is passed to site B to use for 24 hours.

Is this the same token? (So if you logged into Site A via site B, 23hrs59mins after logging into site A directly you would only have a minutes access to your info through site B before needing a new token?)

If its not the same token and you store your token in a table which links it to the user would you have multiple tokens per user?

Is it wise to to generate your token(s) as a random uniquely generated code and store it in the database along with the users log in details or is it better to create a token which takes a combination of the log in details and encrypts it (if so, how do you change the token each time).

Upvotes: 0

Views: 906

Answers (1)

Gerrat
Gerrat

Reputation: 29720

Is this the same token?

Well that depends on Site A. Using the same token would mean that Site B has access to everything that your login on Site A allows you to access. If this didn't seem appropriate, then Site A would generate a new token with a more limited access. In this case, there would be multiple tokens per user.

So if you logged into Site A via site B, 23hrs59mins after logging into site A directly you would only have a minutes access to your info through site B before needing a new token?

If it expires 24 hours after creation (which you mentioned), then yes. Often the expiry would be updated upon every access though, so this might renew it for another 24 hours.

Personally, I would (and have) generate token as a random uniquely generated code. I think either would work though, and I'm sure you can find lots of opinions out there, like here or here.

Upvotes: 1

Related Questions