4

I am looking for mechanism to generate random unique alpha numeric key for resetting user password.

I've goggled a lot in this direction, but looks like this thing is not obvious thing.

I've tried something like that:

new String(encodeBase64URLSafe(UUID.randomUUID()));

But after reading the following article: Is UUID.randomUUID() suitable for use as a one-time password? looks like that this way is not fully correct.

It would be really appreciate if you answer on the following questions:

  1. Which is secure way to generate such token using UUID?
  2. Do we need to convert UUID string to base64 in order to have safe URLs or it would be enough to remove dashes from generated string?
  3. Would be it correct to use mechanism from this link in such purpouses How to generate a random alpha-numeric string?, why?
Community
  • 1
  • 1
fashuser
  • 2,152
  • 3
  • 29
  • 51

1 Answers1

8

  1. Using an UUID is safe and secure. The linked article just says that an UUID is maybe a little too much for this kind of security. But well ... if you are "too" secure, no one will blame you.

  2. An UUID is just alpha numeric characters and dashes. So if you need to put it in a query string or an URL, you have nothing to escape. You can remove the dashes to save some space if you want. But it is not required.

  3. This mechanism is secure too. Both (UUID and this one) will works.

For this kind of security, all you have to do is to ensure that your token is randomly generated (even partially).

Magus
  • 14,796
  • 3
  • 36
  • 51