security - Storing authentication tokens in DB -
i have unique authentication token per client, of tokens stored in server database. password, providing access of logged in user's data, assume it'll need obscuring in db somehow. have advice on doing so, please?
i imagine either of following options secure enough, 1 have more cons pros?
encrypt token storage , decrypt during authentication using private key stored in protected file on server.
get client create , store unique key, use hash db token stored on server , send every request, meaning token valid if can verified unique key.
based on limited knowledge, option 2 seems secure, there accepted way of doing this? i'm vaguely aware of how process might work, struggle put practice, links blog articles may aware of awesome!
thanks!
Comments
Post a Comment