Should I make my Logon Application encrypt logon security tokens?

Question

I am working on the security design for a new application at my company. We are using the Windows Identity Foundation framework.

I have a logon application that issues a token to a user who successfully authenticates. The token is then used to access the new application. Of course, this happens transparently to the user.

The WIF framework issues a page with some javascript including the data of the security token that identifies the authenticated user. The javascript instructs the users browser to post the security token data to the application.

There are two specific options for security's sake I'd like to mention.

Token Signing

Token Encryption

Clearly, token encryption is of utmost importance. It is critically important that the application be able to recognize the security token as a valid security token from the logon application.

As for token encryption, I don't know exactly why I need this. The data in the security token simply identifies the user and provides an identifier for the user's session.

My question: Is there some intrinsic thing about security tokens that they need to be not only signed, but encrypted as well?

Answer 1

Implementing your own encryption scheme is difficult and error prone. I highly recommend using a full transport layer security system such as SSL. SSL can be free if you use self-signed certificates or by using Microsoft's PKI which comes with some flavors of Windows Server 2008.