1

I am developing an API via web services in Spring MVC. The user must authenticate, and a cookie set in the client browser. Now this API won't be on the same domain, so I need a way to know when a session on the client has timed out since they will be making API requests after logged in. What is the best secure way to do this? Storing information in session, cache, database to compare with the request cookie on the Server?

1 Answer 1

3

In my case, I generate an unique authentication token for user who has successfully authenticated. Everytime the user needs to invoke any web services, they need to pass the authentication token along.

My authentication token is generated, something like this:-

Date creationDate = new Date();
String key = UUID.randomUUID().toString().toUpperCase() + "|" + userName + "|" + creationDate.getTime();
String authenticationToken = ... // encrypt key with Jasypt

I appended the creation date because it allows me to check against the time-to-live. Everytime the user calls any web service, I'll check the idle duration using the creation date. If the idle duration is less than 30 minutes, I reset the idle duration back to zero and allow the user to execute the web service. However, if the user idles for more than 30 minutes, I consider the authentication token to be invalid, and they have to reauthenticate to get a new token.

6
  • Pretty good idea. Is this secure from any sort of hijacking? Maybe storing the IP in the key, and checking it on the server side? Would I even need to store anything in a database? Will wait for anymore answers before I give you the check.
    – Mike Flynn
    Mar 3, 2011 at 20:33
  • You can certainly append the IP or whatever useful information to make your key more unique. That will allow you to perform a more robust check to ensure the user is the right user. In my case, I have to store the idle duration in the database because I'm running in the cluster environment, so storing data like this in as static map doesn't work well. It's a pretty simple database table that contains the authentication token, user name, creation date, last access date and total accesses (for audit purpose).
    – limc
    Mar 3, 2011 at 20:38
  • I've used a similar approach for an api that I wrote some time ago. It's pretty easy to implement and I really like the principle. Indeed it's vulnerable if sent in clear over the network, but the risk is limited by the validity period of the token and if it's too sensible, then HTTPS should be used between client & server..
    – dSebastien
    Mar 3, 2011 at 21:08
  • Do you recreate the token with the new date to check next time?
    – Mike Flynn
    Mar 23, 2011 at 5:14
  • No, the token is only created one time, per user session. Then, the user can use the same token for multiple requests within that session. When you are checking against the database, all you need is to check against the last authenticated date time of that token. If it is valid, then update the last authenticated date time with current date time then allow the user to proceed with the request.
    – limc
    Mar 23, 2011 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.