18

I am trying to write a token based auth in flask for my android app. For that I need a unique token using which I can verify the user.

Itsdangerous library provide a JSONWebSignatureSerializer function using which I can create JWT token. So my first question is, is it safe to use JWT for mobile based auth ?

Secondly, I did a little bit research on how django rest framework generates its token.

def generate_key(self):
    return binascii.hexlify(os.urandom(20)).decode()

Is this token unique or just a random one? Which one should I use for a mobile based auth?

What is the based way to generate a unique token for mobile application in python ?

davidism
  • 121,510
  • 29
  • 395
  • 339
saprative
  • 371
  • 1
  • 3
  • 14
  • 1
    instead of re-inventing the wheel (usually not a good idea, especially for security) why not use a solution like [flask-jwt](https://pythonhosted.org/Flask-JWT/)? – Burhan Khalid Dec 28 '16 at 03:05

5 Answers5

25

You can use like as mentioned the builtin uuid module. The new secrets module released in 3.6 is also capable of creating unique tokens also.

from uuid import uuid4

rand_token = uuid4()

The function below creates a unique token every time it's called. The os.urandom method returns 20 random bytes as a string and the binascii.hexlify method converts each of those 20 bytes into 2-digit hex representation of that byte. This is why the return value is twice as long.

If you want to use this approach and need tokens to be specific length, use half of the length you need as an argument to the os.urandom method.

def generate_key(self):
    return binascii.hexlify(os.urandom(20)).decode()
Sean Parsons
  • 724
  • 4
  • 12
10

OK, this is old, but I'm chiming in anyway. You need to decide: Do you want unique or random? Choose one.

If you want unique, use UUID. The whole purpose of UUIDs is to make sure you generate something that's unique. UUID stands for Universally Unique ID.

If you want something that's random, use os.urandom. Truly random results cannot be limited to uniqueness constraints! That'd make them not random. Indeed, it'd make them UUIDs.

Now, for your question, you're asking for an auth token. That means you're using this for security purposes. UUIDs are the wrong solution and generating a secure number is the right one. Could you have a collision when generating a random number instead of a UUID? Yes. But it's unlikely unless you've got a gazillion users. You'll want to do your math on this, but my recommendation is: Don't use UUID when you mean to use random.

Oy.

mlissner
  • 17,359
  • 18
  • 106
  • 169
  • 3
    UUID4 has a random generated part. Also to take into account: the probability of generating a duplicate UUID is not zero! But it's small enough to be considered unique. – nnov Nov 26 '20 at 12:59
2

Look at the uuid() library. Docs are here:

https://docs.python.org/2/library/uuid.html

and a previous discussion of the question is here:

How to create a GUID/UUID in Python

with lots of good details.

Community
  • 1
  • 1
vielmetti
  • 1,864
  • 16
  • 23
  • 1
    I have looked into that but none of the python frameworks including django, pyramid uses UUID for token generation. They are using binascii.hexlify(os.urandom(20)).decode() – saprative Dec 28 '16 at 01:35
  • Is this discussion useful? Django has uuid built in. http://stackoverflow.com/questions/3936182/using-a-uuid-as-a-primary-key-in-django-models-generic-relations-impact – vielmetti Dec 28 '16 at 01:43
0

I wrote a little helper function for generating a unique token in django models. You can call it from the save() method of your model. It generates a candidate token using a defined function, searches the existing rows in the database for that candidate token. If it finds one, it trys again, otherwise, it returns the candidate string. Note that there is a small race condition in this, but is unlikely to occur with a token function with a sufficiently large range of outputs.

def generate_unique_token(Model,
                      token_field="token",
                      token_function=lambda: uuid.uuid4().hex[:8]):
"""
Generates random tokens until a unique one is found
:param Model: a Model class that should be searched
:param token_field: a string with the name of the token field to search in the model_class
:param token_function: a callable that returns a candidate value
:return: the unique candidate token
"""
unique_token_found = False
while not unique_token_found:
    token = token_function()
    # This weird looking construction is a way to pass a value to a field with a dynamic name
    if Model.objects.filter(**{token_field:token}).count() is 0:
        unique_token_found = True
return token

Then, you can find a unique token simply by calling

token = generate_unique_token(MyModelInstance, "token_field_name")

It even supports using other methods of generating tokens. For example, if you want to use the full uuid, you can simply call it like this:

token = generate_unique_token(MyModel, "token_field_name", lambda: uuid.uuid4().hex)
George Griffin
  • 634
  • 7
  • 17
  • That seems unnecessary? Aren't Guids/uuids, depending on the algorithm, pretty much guaranteed to be unique? – Moulde Dec 22 '17 at 09:45
  • Perhaps, but this is really useful if you want to get a shorter token, – George Griffin May 03 '18 at 19:31
  • Yeah, the purpose of UUIDs is...in its name! Universally Unique IDs! This is a really weird answer. – mlissner Jun 09 '18 at 15:14
  • UUIDs have the unfortunate property of being fairly long. If you simply truncate the token, you are then sacrificing collision resistance. You can't then just simply save the token into the database and assume that the token will be unique. – George Griffin Dec 13 '18 at 22:00
0

A possible solution is to AES encrypt the time when the token expires + the username which makes it fairly easy to spot expired tokens and requires no extra database space for the tokens

Patrik Radics
  • 43
  • 1
  • 5
  • And if someone finds your secret key? They would have full access to all user accounts on your website... A bad idea. – Hack5 Mar 22 '21 at 22:01
  • that either means your server is poorly secured or b you just used a terrible secret key, besides you can keep it in ram and just random generate it ye users get logged out on server restart but that sounds alright – Patrik Radics Mar 23 '21 at 02:43