Securing authorization tokens using client instance specific secrets
A system, method, and computer program product are provided for securing authorization tokens using client instance specific secrets. Tokens are valid for service requests only if time constraints and additional security constraints are met by additional information stored in the token in hashed form. A required comparison of a timestamp in a client service request header to the current server time limits the useful token life, e.g., to a few minutes. The service request header also includes data generated based on a secret previously assigned to a specific client instance. The secret may be generated by the server according to a public/private key scheme and sent to a particular client instance only once, e.g., during initial device registration. The secret may be omitted from service requests for public information. Service request headers may include device identifiers, so that service requests from known rogue clients may be ignored.
1. A computer-implemented method, the method comprising:
transmitting a token, a hashing key, and a hashing algorithm to a client, wherein the hashing algorithm and the hashing key are included in the token;
receiving a service request from the client, the service request comprising the token provided to the client, a signature generated by the client, and a client timestamp, the signature being generated based on the hashing key, the hashing algorithm, and the client timestamp;
validating the signature by comparing the signature with a hash calculated by a server using the hashing key, the hashing algorithm, and the client timestamp; and
in response to validating the signature, granting the service request.
2. The method of claim 1 , further comprising sending a secret associated with the client to the client, and wherein the signature is generated further based on the secret.
3. The method of claim 1 , further comprising sending to the client at least one of a device identifier and an application version number.
4. The method of claim 3 , further comprising selectively invalidating service requests having a device identifier associated with a fraudulent client.
5. The method of claim 1 , wherein the server retrieves the hashing key and the hashing algorithm from the token in the service request.
6. The method of claim 5 , further comprising determining if the client timestamp and a current server time are within a predetermined time span.
7. The method of claim 6 , wherein the predetermined time span comprises five minutes.
8. The method of claim 1 , wherein the signature is generated further based on the token.
9. The method of claim 1 , wherein the service request is for access to an online resource.
10. A non-transitory computer-readable storage medium having embedded therein a set of instructions which, when executed by at least one hardware-implemented processor of a computer, cause the computer to execute operations, the operations comprising:
transmitting a token, a hashing key, and a hashing algorithm to a client, wherein the hashing algorithm and the hashing key are included in the token;
receiving a service request from the client, the service request comprising the token provided to the client, a signature generated by the client, and a client timestamp, the signature being generated based on the hashing key, the hashing algorithm, and the client timestamp;
validating the signature by comparing the signature with a hash calculated by a server using the hashing key, the hashing algorithm, and the client timestamp; and
in response to validating the signature, granting the service request.
11. The medium of claim 10 , wherein the operations further comprise sending a secret associated with the client to the client, and wherein the signature is generated further based on the secret.
12. The medium of claim 10 , wherein the operations further comprise sending to the client at least one of a device identifier and an application version number.
13. The medium of claim 10 , wherein the server retrieves the hashing key and the hashing algorithm from the token in the service request.
14. A system comprising:
a hardware-implemented processor and a memory that are configured to execute stored instructions to:
transmit a token, a hashing key, and a hashing algorithm to a client, wherein the hashing algorithm and the hashing key are included in the token;
receive a service request from the client, the service request comprising the token provided to the client, a signature generated by the client, and a client timestamp, the signature being generated based on the hashing key, the hashing algorithm, and the client timestamp;
validate the signature by comparing the signature with a hash calculated by the system using the hashing key, the hashing algorithm, and the client timestamp; and
in response to validating the signature, grant the service request.
15. The system of claim 14 , further comprising sending a secret associated with the client to the client, and wherein the signature is generated further based on the secret.
16. The system of claim 14 , further comprising sending to the client at least one of a device identifier and an application version number.
17. The system of claim 14 , wherein the system retrieves the hashing key and the hashing algorithm from the token in the service request.