3 ms·
It's very possible I completely misunderstood your suggestion, however in case I didn't. If you're storing the key on the client (cookie or w/e) and in the dat
by rapind 9y ago
It's very possible I completely misunderstood your suggestion, however in case I didn't.
If you're storing the key on the client (cookie or w/e) and in the database and solely using it to authenticate, aren't you going to run into timing attacks if you're using it for retrieval?
What I typically do is also store a unique identifier like email for the lookup and then use a random key for comparison / validation.
- infogulch 9y agoYeah could the DB token lookup timings by itself be used to find a real token? It might be several layers deep and DBs are noisy, but I think it's still possible in theory. Could you get around this by only storing some hash of both the token and a DB secret?