What's the best way to handle network authentication on repeated requests?
How safe is it to create a unique key on authentication and have the client use that on further requests? I guess that's the most used method online, with cookies and all. It's just that I have to make my own implementation of it, wondering how safe that could be. What if someone different starts making requests with fake keys, see if any work?
Ok, so here's the state-of-the-art layout for this.
(1) The token should be impossible to reverse-compute to get to username / password in reasonable time
(2) The token should differ each time it is computed from username / password
(3) The token should not be computed trivially (like, "md5-hash of usernamepassword plus salt" is weak)
(4) The token should be registered as being in use, and should time out eventually (this is why it's called a session)
(5) When transferring requests from user to server, the tokens are part of them; the transfer should be encrypted to make man-in-the-middle attacks extremely hard
(6) When transferring the token (actually, data in general) from server to user, the transfer should also be encrypted
(7) The transfer encryption should be strong
(8) The server should be safe regarding login as admin, services running, firewall configuration, internal communication encryption
(9) You have to assume the client is in a safe environment (legally, you have to actually demand this, or invalidate the session extremely early)
So 1-3 tell you that you should look for readymade solutions to compute tokens. Consider OAuth.
4 is just housekeeping; persist sessions in a database.
5-7 are supposed to be solved with something like OpenSSL or OpenSSH at the least, depending on what your network service is.
8 means you need to administrate the server well.
9 is Terms Of Use territory.
If you've done all that, tokens can STILL be guessed, but they CANNOT be trivially stolen or derived or anything if your client is running in a safe environment.
Let me give an example:
To operate the Facebook Graph API, all you need is a token (a user token for instance). The token is a string. If you make the request to alter a Facebook page, and you provide a valid token associated with a user, and that user is allowed to alter the page, then the alteration will take place regardless of whether the token was guessed or stolen or rightfully obtained.
But guessing the token is superhard.
That's all there is to say about that.
It's a lot of work getting all of this right. So you need to gradually introduce 1-9 (not in that order though).