jordelver
I have a form where a user submits their email, a record is inserted into the database, and the database id is added to the session. They are then redirected to a LiveView where the session is passed.
In case the user closes their browser or they want to find their page for any reason, I want to send an email and SMS containing a link. When they click the link they should end up back on their particular page.
So I need to generate a token for them.
Phoenix.Token seems like it would work, but it generates a long string, which would work fine for sending in an email, but is too long for an SMS.
Is it secure enough to just generate a random token, save to the database, and include that in a URL? What length is considered “good enough”?
No personal information is available on the user’s page and the page is short lived.
I’m paranoid about security after reading so much! Thanks.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Producing high quality Elixir screencasts since 2017.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #blog-post
- #elixirconf-us
- #elixir-ls
- #ai
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 5- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
hauleth
Depends on your security margin requirements and expected amount of traffic.
dom
OWASP is a good resource for this kind of question:
jordelver
I’m not familiar with this term. Could you explain more?
This is a toy app at the moment but I want to learn the best practice in case it ever did take off.
jordelver
Thank you, that’s really useful. Sounds like 16 bytes is the minimum for this sort of token.
jordelver
I was just looking at how
phx.auth.gengenerates tokens and they do this: