Skip to main content

Insecurely generated token

Need​

Secure token generation mechanism

Context​

  • Usage of PHP for server-side scripting and web development
  • Usage of md5 for generating MD5 hashes

Description​

Non compliant code​

<?php

public function generateToken($user) {
    $token = md5($user->id . time());
    return $token;
}

?>

The above code represents a function generateToken() that creates a token for a user. The token is generated by concatenating the user's ID and the current time, and then applying the md5() function to it.

The md5() function is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value. It is commonly used to check the integrity of data. However, it is not suitable for functions like password storage or token generation because it is not secure against collision attacks.

In the context of token generation, the use of md5() is a security vulnerability because it can be cracked with relative ease due to its known vulnerabilities. An attacker could potentially guess the user ID, and by using the time of token generation (which could also be guessed or known), they could generate the same MD5 hash. This would allow them to impersonate the user, leading to potential unauthorized access and data breaches.

To fix this vulnerability, a more secure method of token generation should be used. This could be a cryptographically secure pseudorandom number generator (CSPRNG) or a strong hashing function such as bcrypt. Additionally, including a secret key in the token generation process can also increase security.

Steps​

  • Replace the MD5 hashing algorithm with a more secure one, such as SHA-256 or SHA-3.
  • Use a cryptographically secure random number generator to create a salt.
  • Combine the salt with the user's id and the current time to create the token.
  • Hash the combined string using the secure hashing algorithm.
  • Store the salt along with the hashed token. When validating the token, you will need to combine the stored salt with the provided token and hash it again, then compare it to the stored hashed token.

Compliant code​

<?php

use Illuminate\\Support\\Str;

public function generateToken($user) {
    $salt = Str::random(32); // Generate a cryptographically secure random salt
    $token = hash('sha256', $user->id . time() . $salt); // Hash the combined string using SHA-256
    return ['token' => $token, 'salt' => $salt];
}

?>

The updated code now uses a cryptographically secure method for generating tokens.

Firstly, we generate a cryptographically secure random salt using Laravel's Str::random function. This function generates a random string of the specified length using PHP's random_bytes function, which is considered cryptographically secure.

Next, we combine the user's id, the current time, and the newly generated salt to create a string that will be hashed to create the token.

We then use PHP's hash function with the 'sha256' algorithm to create the token. SHA-256 is a secure hashing algorithm that is currently recommended for most cryptographic purposes.

Finally, we return an array containing both the hashed token and the salt. The salt needs to be stored along with the token, so that it can be used to validate the token later. When validating the token, you will need to combine the stored salt with the provided token and hash it again, then compare it to the stored hashed token. This ensures that even if an attacker manages to obtain the hashed token, they will not be able to generate the same hash without also knowing the salt.

References​

Last updated on