Most likely a dumb question but how do I create a static bearer token that someone can send back to me when using my API?

Are you wanting a token that expires like Oauth or just a one-time token for that user>?

A one-time token I think

It's not related to their password and can be rotated if compromised and we use it to authenticate API calls

Yes, just a one-time token that I could rotate if required. Is there a special, recognised, way to generate them?

For what it's worth, forgebox uses a sha-512 hash of a new GUID joined with the current time to try and have good randomness

personally I think the CSRFGenerateToken() and CSRFVerifyToken() functions could possible do the trick if I am understanding your need correctly

Ah, I didn't think of

csrfGenerateToken()

, thanks.

Lucee's implementation of that BIf basically this

public static String createRandomStringLC(int length) {
		if (length < 1) return "";
		SecureRandom sr = new SecureRandom();
		StringBuilder sb = new StringBuilder();
		for (int i = 0; i < length; i++) {
			int rnd = (int) (sr.nextDouble() * (CHARS_LC.length - 1));
			sb.append(CHARS_LC[rnd]);
		}
		return sb.toString();
	}

where CHARS_LC is an array of lower case letters and the length is 40

I don't think I have ever used

csrfGenerateToken()

to prevent cross site request forgery but I have used it for other things, like generating a token for forgot password links that get emailed to users and stuff like that.

The thing I like about ForgeBox's approach is the inclusion of the date means the same token could never be generated twice

Thank you both, plenty of options to think about.

I think @ben had something on this about a decade ago.. Anyrate, you could do something like this: <cfset token = hash(getTickCount(), "SHA-256")> <cfif structKeyExists(getHTTPRequestData().headers, "Authorization") AND getHTTPRequestData().headers.Authorization EQ "Bearer #token#">

Yes, I should have remembered, all questions lead to an answer from Ben 🙂

I would not recommend ben's version at all.

🤔

That's why the forgebox version above takes the time AND a GUID (which uses your machine's randomness into account)

Or you can turn all those lines into basically this: <cfset guid = createUUID()> <cfset currentTime = timeFormat(now(), "HHmmss")> <cfset dayOfMonth = left(day(now()), 1)> <cfset lastLetterOfHour = right(hour(now()), 1)> <cfset token = hash("#guid##currentTime##dayOfMonth##lastLetterOfHour#", "SHA-256")> <cfif structKeyExists(getHTTPRequestData().headers, "Authorization") AND getHTTPRequestData().headers.Authorization EQ "Bearer #token#">

You're not adding any entropy by chopping up the date like that

Its entropic enough

Plus now you've basically come full circle to what I said ForgeBox was doing above

its either is or isnt what forgbox is doing

Whether you format the date or use the tick count, it's not random. That's the key here. Predictability has low entropy regardless of the format

hah

That's a nonsense statement. The current date/time is predicable. A (well-written) random library is not predictable.

Actually the first function call is this: https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-functions/functions-c-d/CreateUUID.html

Honestly, just using a GUID here is probably just as secure as anything, lol. Sha 512 hashing it will make it look longer, but again, it's not actually adding any entropy if a hacker knows you sha-512 has your values.

We are taking a random number, crapping it to another random number, then taking two random numbers by a moment of time, binding it all, and encrypting it. Its random enough 🙂