Home/ Questions/Q 3223674
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-17T16:08:04+00:00

I need to develop a feature in the system which allows unregistered users to

  • 0

I need to develop a feature in the system which allows unregistered users to get one-off system access via URL token that is generated/sent by an authenticated user.

For example, a user logs in and wants to share a piece of information so the system generates a URL like http://host/page?token=jkb345k4b5234k54kh5345kb34kb34. Then this URL is sent to an unregistered user who would follow the URL to get some limited access to normally protected data.

First question – are there any standards (RFC? IETF? others?) that would be defining URL generation? The only ones I was able to find are RFC2289 and OpenToken, but none of these are directly related to what I need to do and the latter is only in a second draft state.

There is another design consideration: whether to use one way crypto hash functions and store the payload in a local data store VS using private-public key pairs and encode all necessary payload in the unique string itself.

At the moment I am heavily leaning towards one way hash as it would give me much more freedom (no dependency between payload size and generated string) and less potential problems in the future (e.g. what if I decide to add more payload – how to ensure backwards compatibility). Last but not least, accidental exposure of server-side private key would require massive efforts in key regeneration, update of all live instances, etc. None of these problems are relevant if choosing one-way hash option, but maybe there’s something I overlook? RFC2289 prefers one way crypto function whereas OpenToken chooses the key pair option.

And finally, is anybody aware of any Java library for generating these?

Thanks in advance.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Also have a look at http://en.wikipedia.org/wiki/Universally_unique_identifier and RFC4122. Inside the backend you would need to attach the generated uuid to your entity so verification based on the UUID can be done later.

    Apart from that most often the token could include some data (e.g. versioning+userdata) and then a secure MD5-hash is used to ‘obfuscate/anonymize’ it. Later then the data is concatenated by server and the hash-values are compared again.

    Regarding java-lib and uuid have a look at UUID-javadoc.

    • 0