Token-based authentication is a type of authentication that generates encrypted security tokens. It enables users to verify their identity to websites, which then generates the unique encrypted authentication token. That token then provides users with access to protected pages and resources for a limited period of time without having to re-enter their username and password.
Token-based authentication works through a five-step process:
Token-based authentication proves that the user has been provided access to applications, websites, and resources without having to verify their identity every time they navigate to a new site. Websites can also add additional layers of security beyond traditional passwords without forcing users to repeatedly prove their identity, which improves both user experience and security.
All authentication tokens provide users with access to a device or application. However, there are several different types of tokens that can be used to verify a user’s identity, from software tokens to physical tokens. Here are a few common types of tokens that are being used by developers to authenticate users or service accounts today.
Hardware tokens, sometimes called authentication or security tokens, are physical devices that enable the authorization of users to access protected networks. The purpose of a hardware token is to add a layer of security via two-factor or multi-factor authentication. The token user links the token to the system or service they want to access.
Hardware tokens are designed for seamless user experience and customizability which allows them to be available in multiple forms. The most common types of tokens are key fobs, USBs, and wireless tokens. Hardware tokens can be divided into three categories:
A JSON Web Token is an open standard (RFC 7519). It defines a simple, self-contained method for transmitting information between parties securely. A JWT standard uses JavaScript Object Notation (JSON) objects to transmit tokens between parties. These tokens can be used for authentication, and for the transfer of additional information about the user or account.
Because a JWT is so small, they can be sent as URL’s, POST parameters, or HTTP headers, and can be transmitted quickly. The JWT contains all the necessary information about the entity, to avoid multiple queries to the database. The JWT receiver doesn’t need to call the server to validate the token.
A JWT is composed of three parts:
One-time password (OTP) tokens are secure hardware devices or software programs that can generate one-time passwords. Most commonly, these are personal identification numbers (PIN), numeric codes between 4-12 digits.
Smartphones are commonly used to generate or receive one-time passwords. Once a user proves ownership of their phone, they can use an authenticator app that generates OTP passwords—in this case the phone serves as a code generator. Alternatively, OTPs can be sent to the device by SMS.
One-time password tokens enhance existing identity and password systems by adding dynamically generated credentials. Depending on the provider, OTP tokens generate PINs either synchronously or asynchronously:
API tokens are used as unique identifiers of an application requesting access to your service. The service then generates an API token for the application to use when requesting your service. The API Token can then be matched with the one you have stored to authenticate and provide access.
API tokens have gained popularity as they have replaced the unsafe practice of sending username and password combinations over HTTP.
Token-based authentication works through a five-step process:
This token-based process proves that the user has been provided access to applications, websites, and resources without having to verify their identity every time they navigate to a new site. Websites can add additional layers of security beyond traditional passwords without forcing users to repeatedly prove their identity, which improves both user experience and security.
An authentication token is formed of three key components: the header, payload, and signature.
Header – The header defines the token type being used, as well as the signing algorithm involved.
Payload – The payload is responsible for defining the token issuer and the token’s expiration details. It also provides information about the user plus other metadata.
Signature – The signature verifies the authenticity of a message and that a message has not changed while in transit.
These tokens are the digital version of a stamped ticket to an event. The user or bearer of the token is provided with an access token to a website until they log out or close the service.
As cybercrime becomes more sophisticated, managed service providers must continuously update their security techniques and policies. Due to the increase in attacks that target credentials via methods like phishing, or brute force and dictionary attacks, authentication can no longer rely on passwords alone.
When combined with additional authentication techniques, token-based authentication can create a more complex barrier to prevent sophisticated hackers from exploiting stolen passwords. Tokens are only retrievable from the unique device that created them such as a smartphone or key fob, making them a highly effective authorization methodology today.
It should be noted that while there are many advantages to authentication token platforms, some risk always remains. Tokens that are housed in mobile devices are convenient to use but may be exposed through device vulnerabilities. If the tokens are via SMS, they can easily be intercepted in transit. If a device is lost or stolen, a malicious actor can gain access to the tokens stored in it.
Token authentication should be considered as one component in a two-factor or multi-factor authentication strategy.
Advantages
Disadvantages
Authentication tokens are meant to enhance your security protocols and keep your server safe. To make token work effectively, you need to build your processes with safety in mind.
Your authentication tokens should be:
Don’t take your authentication token decision lightly. Do your homework, ask your peers, and ensure that you’re doing the best job you can for your company.