News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by oxymoron on Tuesday January 16, 2018 @12:16PM (#16159858)
I’ve frequently used the equivalent of HMAC_SHA512(long_secret,uid + ’|’ + timestamp) to generate a token on the server, which the client can retain and pass along requests, and can be verified on the server without persistence. I assume this is what you refer to as stateless authentication. While I agree that there are no real performance reasons to do so, it seems convenient to me every now and then. Is there a security reason to stop doing so?
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by bb88 on Tuesday January 16, 2018 @12:39PM (#16160085)
Only if the long_secret was made public.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by LanceH on Tuesday January 16, 2018 @01:25PM (#16160617)
How do you revoke access to that token?
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by oxymoron on Tuesday January 16, 2018 @05:55PM (#16163574)
Well, you don’t, so if that’s a requirement you’ve got to do it some other way.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by e12e on Tuesday January 16, 2018 @07:10PM (#16164192)
You can rotate the secret to invalidate all tokens.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by tptacek on Wednesday January 17, 2018 @11:15AM (#16169065)
No, you can't. That breaks all of your users, and so you'll rarely do it, even when it might be warranted. Don't engineer security countermeasures that you (a) might need to rely on and (b) will be afraid to use.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by e12e on Wednesday January 17, 2018 @06:01PM (#16172903)
Good points. But for some types of apps, you might have groups of users (a company, team, municipality) that you might be able to afford the cost of "everyone log in again". Or you might be able to safely log out everyone after business hours (if in the same timezone).
[ Parent | on HN ]