I have a form where a user submits their email, a record is inserted into the database, and the database id is added to the session. They are then redirected to a LiveView where the session is passed. In case the user closes their browser or they want to find their page for any reason, I want to se…

Depends on your security margin requirements and expected amount of traffic.

[image] jordelver: Is it secure enough to just generate a random token, save to the database, and include that in a URL? What length is considered “good enough”? OWASP is a good resource for this kind of question: Session ID Length - Session Management - OWASP Cheat Sheet Series …

[image] hauleth: security margin requirements I’m not familiar with this term. Could you explain more? [image] hauleth: expected amount of traffic This is a toy app at the moment but I want to learn the best practice in case it ever did take off.

[image] dom: OWASP is a good resource for this kind of question Thank you, that’s really useful. Sounds like 16 bytes is the minimum for this sort of token.

I was just looking at how phx.auth.gen generates tokens and they do this : token = :crypto.strong_rand_bytes(32) hashed_token = :crypto.hash(:sha256, token) Base.url_encode64(token, padding: false)

Generate token for email and SMS

Questions & Help Questions

dom March 15, 2021, 10:18am 3

OWASP is a good resource for this kind of question: