Hello.
I want to understand what is a token based authentication . I searched in the internet but couldn't find anything understandable.
+3
A:
A token is a piece of data which only Server X could possibly have created, and which contains enough data to identify a particular user.
You might present your login information and ask Server X for a token; and then you might present your token and ask Server X to perform some user-specific action.
Tokens are created using various combinations of various techniques from the field of cryptography as well as with input from the wider field of security research. If you decide to go and create your own token system, you had best be really smart.
Justice
2009-10-20 05:02:28
Generally, if you want token-based authentication, you should start with OAuth.
Bob Aman
2009-10-20 05:04:30
OAuth is certainly viable in a Web-based application. But, for example, operating system login sessions use token systems as well, as do many other kinds of software program, so this idea is not limited to the Web.
Justice
2009-10-20 05:07:30
+3
A:
I think it's well explained here -- quoting just the key sentences of the long article:
The general concept behind a token-based authentication system is simple. Allow users to enter their username and password in order to obtain a token which allows them to fetch a specific resource - without using their username and password. Once their token has been obtained, the user can offer the token - which offers access to a specific resource for a time period - to the remote site.
In other words: add one level of indirection for authentication -- instead of having to authenticate with username and password for each protected resource, the user authenticates that way once (within a session of limited duration), obtains a time-limited token in return, and uses that token for further authentication during the session.
Advantages are many -- e.g., the user could pass the token, once they've obtained it, on to some other automated system which they're willing to trust for a limited time and a limited set of resources, but would not be willing to trust with their username and password (i.e., with every resource they're allowed to access, forevermore or at least until they change their password).
If anything is still unclear, please edit your question to clarify WHAT isn't 100% clear to you, and I'm sure we can help you further.
Alex Martelli
2009-10-20 05:05:59