Question

I am developing ASP.NET MVC WEB API service. As everywhere i need security tokens. I have an idea to generate guid using dtabase info. For isntance i need to take entity from db, then take id, datecreated and crete guid usin this info. It will be token that will be send to client. SO he can access his data.

Problem is that i dont know how to generate it. Please advice me something to make it work.

I found interesting article http://www.singular.co.nz/blog/archive/2007/12/20/shortguid-a-shorter-and-url-friendly-guid-in-c-sharp.aspx for shortening GUID.

Any help would be appreciated,
Dima.

Answer 1

I’d just store an AccessKey uniqueidentifier not null unique along with every entity. You can hand that out to clients. That way you don’t need to mess with encryption or hashing.

Just make sure not to use Guid.NewGuid() for this as it is not cryptographically strong. Use this:

public static class SecureGuidGenerator
{
    [ThreadStatic]
    static RandomNumberGenerator rng;

    public static Guid GetNext()
    {
        if (rng == null) rng = RandomNumberGenerator.Create();
        var bytes = new byte[16];
        rng.GetBytes(bytes);
        return new Guid(bytes);
    }
}