0

I'm currently developing a login API for use across two different platforms. It's pretty straightforward, simply comparing an email and hashed password in the database and returning a unique token (stored as a cookie) for future data retrieval.

It works perfectly at the moment. However, any malicious user could abuse this system by visiting the API endpoint and constantly logging in, generating an infinite amount of tokens in the database.

So, what is the best approach to preventing something like this? The only solution I could develop is a unique device identifier. Still, browsers heavily restrict that information and an attacker could always spoof the data.

Here's my current logic in PHP (note that this is simplified and actually returns a JSON object):

/* /api/handle/login.php */

$email = Input::post("auth_email") ?? "";
$password = Input::post("auth_pass") ?? "";

$user = new User;
$user->login($email, $password);

// Check that the user credentials are correct.
if(!$user->loggedIn()){
    echo "Failed to login.";
}

// Retrieves an authentication generated on $user->loggedIn().
echo $user->authToken();

Now I cannot generate only one token per user, as this would mean they would be signed out every time they sign in on a new device. Same thing for IP identification.

GROVER.
  • 4,071
  • 2
  • 19
  • 66
  • 2
    1. Generate random tokens. 2. Make the potential token space so large that an attacker cannot reasonably disrupt functionality. 3. Set token expiry time. 4. Delete expired tokens. 5. Rate-limiting. – Sammitch Apr 07 '22 at 22:31
  • @Sammitch Tokens are generated randomly. Can you elaborate on "token space"? I have a token expiry time, however, it is for 90 days - and these do delete on expiry. – GROVER. Apr 07 '22 at 22:42
  • Longer token == larger space for potential tokens. That said, a 90 day auth expiry is quite long, which will allow for significant accumulation of unused tokens. You could also cap the number of active tokens that any one user can have at a time. – Sammitch Apr 07 '22 at 22:50
  • As for space, see this discussion on the UUID format: https://stackoverflow.com/a/1155027/231316 – Chris Haas Apr 08 '22 at 03:20

0 Answers0