3 ms·
Run the token through a secure HMAC function before storing it in the DB. Problem solved. KISS. :)
by ezekg 5y ago
Run the token through a secure HMAC function before storing it in the DB. Problem solved. KISS. :)
- iudqnolq 5y agoWhy would something derived from a random string have better comparison properties than the random string?
- ezekg 5y agoYou can’t perform a timing attack for a token “foo” in SELECT WHERE token = :token if the token stored in the DB is the HMAC of “foo”. E.g. trying “f” and then “fo” produce 2 entirely different, random tokens from the query’s POV. The attacker could never deduce that the correct token is “foo.”