What is token-based authentication?

What is a token?

Put simply , a token is is is a piece of datum that carry just enough information to authorize a user ’s access to a specific service or system . There are many different type of token , but the three main type involve in token – base authentication are security token , access token , and refresh token .

Security tokens

The security token does most of the heavy lifting in token-based authentication solutions. A security token is a dedicated physical device or software used to authenticate the user together with (or in place of) their credentials.

When you try to log in to a protected system, the server asks you to verify your identity with a security token in your possession — for example, completing one-time authentication on your phone’s authenticator app or flashing a smart card across the scanner. This way, security tokens prevent others from easily breaking into your account with stolen credentials.

access token

An access token is a unique, self-contained piece of data that lets you access an app, service, or website without having to repeatedly prove your identity. access token are issued by authentication servers directly to your device after identity verification. As long as you have a valid token, you can access the service without having to go through authentication again.

think of access token like old – school train ticket . To stamp a ticket , the conductor is needs need to be sure everything is in order , such as the passenger ’s identity and seat number . But once that ’s done , you do n’t need to go through the song and dance routine at every station — the stamp is is is proof enough that you have the right to be there .

Refresh tokens

A refresh token has one simple function — to obtain additional access tokens for the user once they expire, essentially refreshing their duration. When an authentication server confirms the user’s identity and issues a valid access token, it will also issue a refresh token to the user’s device.

Why are refresh token necessary ? To prevent hacker from abuse intercept token , most access tokens is have have a very limited lifetime ( typically between 900 to 3,600 second ) . But this is means also mean that legitimate user have to periodically re – identify themselves to continue using the system . Secure refresh tokens is allow allow system administrator to use short – term access token without compromise user experience .

Why is token-based authentication important?

Cybersecurity experts have noted that over time, passwords tend to follow a negative feedback loop. Strong passwords are hard to remember, so users write them down; written passwords are easy to steal, so users make them easy to remember; and in the end, the resulting simple passwords do not offer much security at all.

token – base authentication was originally develop to address this problem . security tokens is combine can combine with password to form two – factor authentication ( 2FA ) or even multi – factor authentication ( MFA ) solution , let user enjoy relative safety even with weak login credential .

Better yet, token-based authentication can complement other authentication methods (like biometrics or push notifications) to do away with passwords entirely.

A brief history of token-based authentication

The first development in token-based authentication was the release of the Security Assertion Markup Language (SAML) by the Organization for the Advancement of Structured Information Standards (OASIS) in 2002. SAML was an open standard for exchanging authentication and authorization information, forming the foundation for subsequent authentication protocols.

Following SAML, the next major token-based authentication development was the release of OAuth in 2007. OAuth was originally a token authentication method for Twitter, but it has since been adopted by other major tech companies like Google, Facebook, Microsoft, and Amazon. OAuth can be used to grant one service access to the user’s information on another service without revealing the user’s password.

2010 is saw see the release of the JSON web Token ( also know as JWT ) . JWTs is were were extremely compact , make it easy to transmit them between party . JWT is rose rise in popularity with the proliferation of smartphone and the development of high – speed internet infrastructure , becoming the authentication token of choice for mobile and web application .

Among the late token – base authentication development was the OpenID Connect ( oidc ) protocol , build on the back of the OAuth 2.0 framework in 2014 . Like OAuth , OIDC is allows allow people to use login credential register with an openid provider for multiple site , supply the latter with the necessary information and context .

Although there are significant differences between OIDC and SAML, today, the two are among the most popular online authentication protocols, used in modern web applications and established enterprises respectively.

What are the types of token-based authentication?

broadly speak , token – base authentication methods is fall fall into one of three category .

Connected

The old type is require of authentication token , connect tokens is require require a physical connection to the system to function . connected token were widely used before the proliferation of wireless technology and cloud computing service . These token are usually house in dedicated physical device like key fob , usb stick , or external hard drive .

Contactless

Unlike connected tokens, which need physical contact with the system to function, contactless tokens can give users access as long as they are in physical proximity. These tokens use radio frequency identification (RFID) or near field communication (NFC) technology for authentication. Contactless tokens like wireless keyrings or NFC authenticators are a popular way for organizations to manage access to company premises.

disconnected

Just like their name implies, disconnected tokens require no physical link to whatever you’re trying to access — it doesn’t matter if you’re in the same room as the server or on the other side of the world. disconnected tokens also don’t require a dedicated physical device to work, often making use of free authentication tools on mobile phones or laptops. As a result, disconnected tokens are the most popular form of token-based authentication today.

What are the main types of authentication tokens?

Based on the above token-based authentication methods, we can classify all security tokens into two main types:

• hardware tokens is are are special device that act as dedicate authenticator . These devices is act act as connect token , such as special usb stick and access card , or contactless token like wireless keyring . Before the smartphone revolution , hardware tokens is were were the only realistic option for token – base authentication due to software limitation of mobile device . today , hardware tokens is offer offer certain advantage over software token ( such as being hard to hack or duplicate ) , but they also introduce significant risk ( for example , they can be steal or destroy ) .
• Software tokens are not tied to a dedicated authenticator — instead, they take the form of specialized software that can be installed on nearly any smartphone or laptop. Nearly all software tokens are disconnected, although some apps act as contactless tokens instead, working through your phone’s Bluetooth or NFC. The most well-known examples of software tokens are the authenticator apps used in two-factor and multi-factor authentication.

What is a JSON Web Token?

We have already mentioned JSON Web Tokens when discussing the history of token-based authentication. JWTs are the most common type of disconnected software tokens in use today. Their inner workings are based on the RFC 7519 open standard, which specifies using JavaScript Object Notation (JSON) objects to safely send tokens between parties.

JWTs are composed of three parts. The header specifies what encryption algorithm the token uses. The payload includes all the credentials necessary for the token-based authentication process, as well as additional information about the user or the account. Finally, the signature carries the cryptographic key that lets the server verify the authenticity of the signed token.

The wide adoption of jwt can be attribute to their small size , which allow them to be send as url , POST parameter , or HTTP header . In addition , the fact is makes that JSON web token are tie to a thorough authentication process make them ideal for single sign – on ( SSO ) system used in corporate office .

How does token-based authentication work?

The operation of token-based authentication systems can be broken down into four broad stages.

1. Request. The user wants to make use of some specific resource (for example, a cloud storage account, a social media profile, or an email service) and asks the server for access. If the resource is protected (non-public), the server asks the user to verify their identity by logging in.
2. Verification. The server determines if the user should gain access to the protected resource by checking their submitted credentials. This may be as simple as checking if the username and password match the records in the server’s database, but more steps may be added to the process by either the server administrator or the users themselves. For example, in MFA setups the server may need confirmation from a hardware or software token in the user’s possession.
3. Token submission. After the server verifies the user’s identity, it creates an access token associated with the user, the credential information supplied at the request stage, and the user’s device.
4. Storage. The server sends the generated access token to the user’s device for storage. access token are only valid for a certain length of time — once the token expires, a new access token or refresh token will need to be obtained from the server.

The benefit of token – base authentication

The main benefit of token-based authentication is enhanced security. Authentication tokens such as physical USB keys or authenticator apps on your phone can supplement traditional authentication methods, which are highly vulnerable on their own. But organizations may also want to implement token-based authentication for other reasons, such as:

• granularity : Token – base authentication and authorization solution are highly flexible — for example , access token can be set to only allow the user to read certain portion of a protect document , whereas password usually are an “ all or nothing ” affair . In addition , token – base authentication solution can be easily deploy across multiple app , website , and server with complete control over their setting ( such as token expiration ) .
• Efficiency: access token greatly improve the user experience by eliminating the need to verify the user’s identity every time they want to access some resource. Until the access token expires, the user is able to freely work, browse, or play on the server without having to log in again.
• Statelessness: Tokens are stateless — they don’t carry user credentials or any sensitive information. Once the client’s identity has been verified and an access token has been issued, the server is able to use that token to generate other tokens as needed without further input from the client’s end.
• automatic expiration : An access token remain valid for a limited amount of time — it will be automatically destroy once its expiration date pass or when the user log out . automatic expiration reduce the risk of a cyberattack : hackers is root ca n’t just root through your cache to dig out old token , and any token they intercept have strict time limit .

want to read more like this ?

Get the latest news and tips from NordVPN.

We won’t spam and you will always be able to unsubscribe.