Are GUIDs secure?

Are GUIDs secure?

GUIDs are designed for uniqueness, not for security.

Will we ever run out of Guids?

Absolutely. Even if only one GUID is generated per second, we’ll run out in a scant 9 quintillion years. That’s well before the heat death of the Universe.

How do I get secure token authentication?

Before we actually get to implementing JWT, let’s cover some best practices to ensure token based authentication is properly implemented in your application.

1. Keep it secret. Keep it safe.
2. Do not add sensitive data to the payload.
3. Give tokens an expiration.
4. Embrace HTTPS.
5. Consider all of your authorization use cases.

When to use short-lived or long-lived access tokens?

Developers strongly prefer access tokens that don’t expire, since it’s much less code to deal with. In order to help mitigate these concerns, services will often build the token refreshing logic into their SDK, so that the process is transparent to developers. In summary, use short-lived access tokens and long-lived refresh tokens when:

What happens to an access token when it expires?

When the service issues the access token, it also generates a refresh token that never expires and returns that in the response as well. (Note that refresh tokens can’t be issued using the Implicit grant.) When the access token expires, the application can use the refresh token to obtain a new access token.

What are the benefits of self encoded access tokens?

The main benefit of this approach is that the service can use self-encoded access tokens which can be verified without a database lookup.

How long do OAuth 2.0 access tokens last?

The OAuth 2.0 spec recommends this option, and several of the larger implementations have gone with this approach. Typically services using this method will issue access tokens that last anywhere from several hours to a couple weeks.