CODEWITHSUNDEEP
authenticationtokenverification
Sabyrzhan
Sabyrzhan

Reputation: 175

Why token scheme is needed?

Many sites with registration that ask email confirmation and sites use tokens in their url.

Why do they use it?

For example in case of email confirmation: why just not use registered user id instead of token?! In case of using it in web pages, i didn't get at all!!

Explanation with real applications would be appreciated!

Thanks in advance!

Upvotes: 0

Views: 208

Answers (1)

Joe
Joe

Reputation: 15802

A token in this context is typically a disposable time-limited random string used for verification. A token of (say) 40 characters can be generated easily [such as sha1(microtime() . rand(1, 10000)))], which isn't guessable by the user and isn't brute-forceable (within reason).

For email verification, a token will be generated and linked with your account ID. When you visit the address containing the token, the account gets activated. Since we've established that a token can't be brute-forced or guessed (within reason), we've just established that a certain user does indeed have the email address they gave us.

If we just used their member number, they could do several things to just guess it, thus bypassing the email check entirely.

When logging in or submitting a form of some kind, the term "token" may be used in a slightly different context - it's still a disposable time-limited random string, but it's used to make sure that the person who submitted the form has just come from the form they tried to submit.

For example, say you log into your online banking. They might have a form to transfer money to another bank account. If you go to www.nastysite.com they might include an iframe that points to <iframe src="http://www.mybank.com/send_money.php?amount=9001&to=Joe">. If your bank don't verify that you were actually on the form, that payment will go through, and you won't be best happy. Even if you are on the form, the chances of the correct token on your form being used in the fake page-load are (almost) nil.

This is called "Cross-Site Request Forgery", or CSRF. For some more reading on CSRF, have a look at this Wikipedia article. Also, I've just got that link after writing this post and seen that they use a very similar example to mine - genuine coincidence haha.

Upvotes: 1

Related Questions