I am parsing a string in C++ using the following:

    using namespace std;

    string parsed,input=&quot;text to be parsed&quot;;
    stringstream input_stringstream(input);

    if (getline(input_stringstream,parsed,&#39; &#39;))
    {
         // do some processing.
    }

Parsing with a single char delimiter is fine. But what if I want to use a string as delimiter.

Example: I want to split:
    
    scott&gt;=tiger

with `&gt;=` as delimiter so that I can get scott and tiger.   
        
  

Parse (split) a string in C++ using string delimiter (standard C++)

I want to understand what token-based authentication means. I searched the internet but couldn&#39;t find anything understandable.

What is token-based authentication?

In my react app i am using [axios][1] to perform the REST api requests.

But it&#39;s unable to send the *Authorization* header with the request.

Here is my code:

    tokenPayload() {
      let config = {
        headers: {
          &#39;Authorization&#39;: &#39;Bearer &#39; + validToken()
        }
      }
      Axios.post( 
          &#39;http://localhost:8000/api/v1/get_token_payloads&#39;,
          config
        )
        .then( ( response ) =&gt; {
          console.log( response )
        } )
        .catch()
    }

Here the `validToken()` method would simply return the token from browser storage.

All requests are having a 500 error response saying that 

&gt; The token could not be parsed from the request

from the back-end.

How to send the authorization header with each requests? Would you recommend any other module with react?


  [1]: https://github.com/mzabriskie/axios

Sending the bearer token with axios

I was using a username password for pushing my code. It was working for several months, but suddenly I&#39;m not able to do it and am getting this error:

```
Username for &#39;https://github.com&#39;: shreyas-jadhav
Password for &#39;https://shreyas-jadhav@github.com&#39;:
remote: Password authentication is temporarily disabled as part of a brownout. Please use a personal access token instead.
remote: Please see https://github.blog/2020-07-30-token-authentication-requirements-for-api-and-git-operations/ for more information.
```

Please note that the link doesn&#39;t help. Even using the generated token doesn&#39;t help.

&gt; **Moderator Note:** This is [part of a planned and soon-to-be permanent service change by GitHub](https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/)



Password authentication is temporarily disabled as part of a brownout. Please use a personal access token instead

From what I&#39;ve learned so far, the purpose of tokens is to prevent an attacker from forging a form submission.

For example, if a website had a form that input added items to your shopping cart, and an attacker could spam your shopping cart with items you don&#39;t want.

This makes sense because there could be multiple valid inputs for the shopping cart form, all the attacker would have to do is know an item that the website is selling. 

I understand how tokens work and add security in this case, because they ensure the user has actually filled in and pressed the &quot;Submit&quot; button of the form for each item added to the cart.

However, do tokens add any security to a user login form, which requires a username and password?

Since the username and password are very unique the attacker would have to know both in order for the login forgery to work (even if you didn&#39;t have tokens setup), and if an attacker already knew that, he could just sign onto the website himself. Not to mention, a CSRF attack that makes the user log himself in wouldn&#39;t have any practical purpose anyway.

Is my understanding of CSRF attacks and tokens correct? And are they useless for user login forms as I suspect?

Do login forms need tokens against CSRF attacks?

I&#39;m learning something about Authorization like Basic, Digest, OAuth2.0, JWTs, and Bearer Token. 

Now I have a question.

You know the JWTs is being used as an Access_Token in the OAuth2.0 standard. JWTs appears at RFC 7519, and Bearer Token is at RFC 6750 .

For example, the Bearer:

    Authorization: Bearer &lt;token&gt;

I used to send token to server by AJAX or add token to the query string of the url. I know that a token can also be sent by adding it to a request header. Does that mean that token should be added to Authorization Bearer header? 

Could you please tell me the relationship between JWTs and Bearer Token? Thanks a lot. 

What&#39;s the difference between JWTs and Bearer Token?

I am trying to write a program where the names of some functions are dependent on the value of a certain macro variable with a macro like this:

    #define VARIABLE 3
    #define NAME(fun) fun ## _ ## VARIABLE

    int NAME(some_function)(int a);

Unfortunately, the macro `NAME()` turns that into

    int some_function_VARIABLE(int a);

rather than

    int some_function_3(int a);

so this is clearly the wrong way to go about it. Fortunately, the number of different possible values for VARIABLE is small, so I can simply do an `#if VARIABLE == n` and list all the cases separately, but is there is a clever way to do it?





How can I concatenate twice with the C preprocessor and expand a macro as in &quot;arg ## _ ## MACRO&quot;?

How can I authenticate a socket.io connection? My application uses a login endpoint from another server (python) to get a token, how can I get use that token whenever a user opens a socket connection on the node side?

    io.on(&#39;connection&#39;, function(socket) {
    	socket.on(&#39;message&#39;, function(message) {
    		io.emit(&#39;message&#39;, message);
    	});
    });

And the client side:

    var token = sessionStorage.token;
    var socket = io.connect(&#39;http://localhost:3000&#39;, {
    	query: &#39;token=&#39; + token
    });

If the token is created in python:

    token = jwt.encode(payload, SECRET_KEY, algorithm=&#39;HS256&#39;)

How can I use this token to authenticate a socket connection in node?

Authenticating socket io connections using JWT

I have used the refresh token several times in just a short period for testing purposes, but I wonder whether Google refresh tokens ever expire? Can I use the same refresh token to get another access token again and again for a long period (a week or even months)?

Do Google refresh tokens expire?

I am going to use oAuth to fetch mails and contacts from google. I don&#39;t want to ask the user each time to log in to obtain an access token and secret. From what I understood, I need to store them with my application either in a database or `SharedPreferences`. But I am a bit worried about security aspects with that. I read that you can encrypt and decrypt the tokens but it is easy for an attacker to just decompile your apk and classes and get the encryption key.  
**What&#39;s the best method to securely store these tokens in Android?**

How to securely store access token and secret in Android?

Please explain to me the working of `strtok()` function. The manual says it breaks the string into tokens. I am unable to understand from the manual what it actually does.

I added watches on `str` and `*pch` to check its working when the first while loop occurred, the contents of `str` were only &quot;this&quot;. How did the output shown below printed on the screen?

    /* strtok example */
    #include &lt;stdio.h&gt;
    #include &lt;string.h&gt;
    
    int main ()
    {
      char str[] =&quot;- This, a sample string.&quot;;
      char * pch;
      printf (&quot;Splitting string \&quot;%s\&quot; into tokens:\n&quot;,str);
      pch = strtok (str,&quot; ,.-&quot;);
      while (pch != NULL)
      {
        printf (&quot;%s\n&quot;,pch);
        pch = strtok (NULL, &quot; ,.-&quot;);
      }
      return 0;
    }

**Output:**
&lt;pre&gt;
Splitting string &quot;- This, a sample string.&quot; into tokens:
This
a
sample
string
&lt;/pre&gt;

How does strtok() split the string into tokens in C?

I have a request URI and a token. If I use:

    curl -s &quot;&lt;MY_URI&gt;&quot; -H &quot;Authorization: TOK:&lt;MY_TOKEN&gt;&quot;

etc., I get a 200 and view the corresponding JSON data.
So, I installed requests and when I attempt to access this resource I get a 403 probably because I do not know the correct syntax to pass that token. Can anyone help me figure it out?
This is what I have:

    import sys,socket
    import requests

    r = requests.get(&#39;&lt;MY_URI&gt;&#39;,&#39;&lt;MY_TOKEN&gt;&#39;)
    r. status_code

I already tried:

    r = requests.get(&#39;&lt;MY_URI&gt;&#39;,auth=(&#39;&lt;MY_TOKEN&gt;&#39;))
    r = requests.get(&#39;&lt;MY_URI&gt;&#39;,auth=(&#39;TOK&#39;,&#39;&lt;MY_TOKEN&gt;&#39;))
    r = requests.get(&#39;&lt;MY_URI&gt;&#39;,headers=(&#39;Authorization: TOK:&lt;MY_TOKEN&gt;&#39;))

But none of these work.






Python requests library how to pass Authorization header with single token

(spawned from [this thread][1] since this is really a question of its own and not specific to NodeJS etc)

I&#39;m implementing a REST API server with authentication, and I have successfully implemented JWT token handling so that a user can login through a /login endpoint with username/password, upon which a JWT token is generated from a server secret and returned to the client. The token is then passed from the client to the server in each authenticated API request, upon which the server secret is used to verify the token.

However, I am trying to understand the best practices for exactly how and to what extent the token should be validated, to make a truly secure system. Exactly what should be involved in &quot;validating&quot; the token? Is it enough that the signature can be verified using the server-secret, or should I also cross-check the token and/or token payload against some data stored in the server? 

A token based authentication system will only be as safe as passing username/password in each request provided that it&#39;s equally or more difficult to obtain a token than to obtain a user&#39;s password. However, in the examples I&#39;ve seen, the only information required to produce a token is the username and the server-side secret. Doesn&#39;t this mean that assuming for a minute that a malicious user gains knowledge of the server secret, he can now produce tokens on behalf of *any* user, thereby having access not only to one given user as would be the fact if a password was obtained, but in fact to *all* user accounts?

This brings me to the questions:

1) Should JWT token validation be limited to verifying the signature of the token itself, relying on the integrity of the server secret alone, or accompanied by a separate validation mechanism?

* In some cases I&#39;ve seen the combined use of tokens and server sessions where upon successful login through the /login endpoint a session is established. API requests validate the token, and also compare the decoded data found in the token with some data stored in the session. However, using sessions means using cookies, and in some sense it defeats the purpose of using a token based approach. It also may cause problems for certain clients.

* One could imagine the server keeping all tokens currently in use in a memcache or similar, to ensure that even if the server secret is compromised so that an attacker may produce &quot;valid&quot; tokens, only the exact tokens that were generated through the /login endpoint would be accepted. Is this reasonable or just redundant/overkill?

2) If JWT signature verification is the only means of validating tokens, meaning the integrity of the server secret is the breaking point, how should server secrets be managed? Read from an environment variable and created (randomized?) once per deployed stack? Re-newed or rotated periodically (and if so, how to handle existing valid tokens that were created before rotation but needs to be validated after rotation, perhaps it&#39;s enough if the server holds on to the current and the previous secret at any given time)? Something else?

Maybe I&#39;m simply being overly paranoid when it comes to the risk of the server secret being compromised, which is of course a more general problem that needs to be addressed in all cryptographic situations...

  [1]: https://stackoverflow.com/questions/30494383/using-jwt-with-active-directory-authentication-in-nodejs-backend

Best practices for server-side handling of JWT tokens

I want to create a C macro that creates a function with a name based
on the line number.
I thought I could do something like (the real function would have statements within the braces):

    #define UNIQUE static void Unique_##__LINE__(void) {}

Which I hoped would expand to something like:

    static void Unique_23(void) {}

That doesn&#39;t work. With token concatenation, the positioning macros
are treated literally, ending up expanding to:

    static void Unique___LINE__(void) {}

Is this possible to do?

Creating C macro with ## and __LINE__ (token concatenation with positioning macro)

In Compiler Construction by Aho Ullman and Sethi, it is given that the input string of characters of the source program are divided into sequence of characters that have a logical meaning, and are known as tokens and lexemes are sequences that make up the token so what is the basic difference?

What is the difference between a token and a lexeme?

On our site, we provide to users a simulation based on their private information (given through a form). We would like to allow them to get back on their simulation results later, but without forcing them to create a login/password account. 

We have thought of sending them an email with a link, from which they could get back their results. But, naturally, we have to secure this URL, because private data is at stake.

So we&#39;re intending to pass a token (like a 40 characters combination of letters and digit, or a MD5 Hash) in the URL and to use SSL.

Finally, they would receive an email like that:

&gt; Hi,  
&gt; Get back your results on
&gt; [https://www.example.com/load_simulation?token=uZVTLBCWcw33RIhvnbxTKxTxM2rKJ7YJrwyUXhXn][1]

What do you think about it? Is it secure enough? What would you advise me for the token generation? What about passing URL parameters in a https request?


  [1]: https://www.example.com/load_simulation?token=uZVTLBCWcw33RIhvnbxTKxTxM2rKJ7YJrwyUXhXn

https URL with token parameter : how secure is it?

I want to generate identifier for forgot password . I read i can do it by using timestamp with   mt_rand(), but some people are saying that time stamp might not be unique every time. So i am bit of confused here. Can i do it with using time stamp with this ?

**Question**  
What&#39;s best practice to generate random/unique tokens of custom length?

I know there are lot of questions asked around here but i am getting more confused after reading different opinion from the different people. 

best practice to generate random token for forgot password

I can&#39;t get my refresh token with my code. I can only get my access token, token type etc.,
I have followed some tutorials like putting `access_type=offline` on my login URL:

    echo &quot;&lt;a href=&#39;https://accounts.google.com/o/oauth2/auth?&quot; 
    	. &quot;access_type=offline&amp;client_id=123345555.apps.googleusercontent.com&amp; &quot;
    	. &quot;scope=https://www.googleapis.com/auth/calendar+https://www.googleapis.com/auth/plus.me&amp;response_type=code&amp; &quot;
    	. &quot;redirect_uri=http://www.sample.com/sample.php&amp;state=/profile&#39;&gt;Google&lt;/a&gt;&quot;;



and my fields in getting the access token:


    $fields=array(
        &#39;code&#39;=&gt;  urlencode($authcode),
        &#39;client_id&#39;=&gt; urlencode($clientid),
        &#39;client_secret&#39;=&gt; urlencode($clientsecret),
        &#39;redirect_uri&#39;=&gt; urlencode($redirecturi),
        &#39;grant_type&#39;=&gt; &#39;authorization_code&#39;,
    );


but I can&#39;t get *refresh_token*, just the *access_token*, *token_type*, *id_token* and *expires_in*.






Get refresh token google api

How can I combine passport-local to return a JWT token on successful authentication?

I want to use [node-jwt-simple][1] and looking at [passport.js][2] I am not sure how to go about.

    var passport = require(&#39;passport&#39;)
      , LocalStrategy = require(&#39;passport-local&#39;).Strategy;
    
    passport.use(new LocalStrategy(
      function(username, password, done) {
        User.findOne({ username: username }, function(err, user) {
          if (err) { return done(err); }
          if (!user) {
            return done(null, false, { message: &#39;Incorrect username.&#39; });
          }
          if (!user.validPassword(password)) {
            return done(null, false, { message: &#39;Incorrect password.&#39; });
          }
          return done(null, user);
        });
      }
    ));


Is it possible to return the token when calling done() ?
Something like this... (just pseudo code)

    if(User.validCredentials(username, password)) {
      var token = jwt.encode({username: username}, tokenSecret);
      done(null, {token : token}); //is this possible?
    }

If not, how can I return the token?


  [1]: https://github.com/hokaccha/node-jwt-simple
  [2]: http://passportjs.org/guide/username-password/

passport-local with node-jwt-simple

I generated a JWT and there are some claims which I understand well, but there is a claim called `kid` in header. Does anyone know what it means?

I generated the token using auth0.com

What&#39;s the meaning of the &quot;kid&quot; claim in a JWT token?

I am working on a web application developed using Java and AngularJS and chose to implement token authentication and authorization.
For the exercise purpose, I&#39;ve come to the point where I send the credentials to the server, generate a random token store it and send it back to the client.
At every request to the server I&#39;m attaching the token in the header and it works perfectly.
For the authentication point of view is perfect and wouldn&#39;t need more.

However, I now want to keep track of the user type (admin, regular user...), as well as it&#39;s id, or any other unique field; as I understood I have to encrypt that in the token that I&#39;m sending back to the client during the log in action. Is that correct?

Is there any JWT library that you used and can generate, encrypt and decrypt such tokens?
A link to the library&#39;s API and Maven dependency would be much appreciated.

Thanks

JWT (JSON Web Token) library for Java

In order to generate a 32 character token for access to our API we currently use:

    $token = md5(uniqid(mt_rand(), true));

I have read that this method is not cryptographically secure as it&#39;s based on the system clock, and that `openssl_random_pseudo_bytes` would be a better solution as it would be harder to predict.

If this is the case, what would the equivalent code look like?

I presume something like this, but I don&#39;t know if this is right...

    $token = md5(openssl_random_pseudo_bytes(32));

Also what length makes sense that I should pass to the function?

Generating cryptographically secure tokens

I&#39;ve tried many things and there&#39;s no way, always appears this error
I tried to use only one option to see if passed, changed the call of jquery, but not.

I looked in various places on the internet about this error, but could not solve or understand why it is happening.
On my pc using EasyPHP works perfectly, but when I put online does not work.

**Syntax Error: unexpected token &lt;**

Here&#39;s my code:

    $(function(){
	$(&#39;#salvar&#39;).click(function(){
		var key = &#39;salvar&#39;;
		var title = $(&#39;#title&#39;).val();
		var opcao1 = $(&#39;#opcao1&#39;).val();
		var opcao2 = $(&#39;#opcao2&#39;).val();
		var opcao3 = $(&#39;#opcao3&#39;).val();
		var opcao4 = $(&#39;#opcao4&#39;).val();
		var opcao5 = $(&#39;#opcao5&#39;).val();
		var opcao6 = $(&#39;#opcao6&#39;).val();
		
		if(title.length &gt; 0){
			if(opcao2.length &gt; 0){
				$(&#39;#resposta&#39;).removeClass().html(&#39;Salvando a enquete...&lt;br clear=&quot;all&quot;&gt;&lt;br&gt;&lt;img src=&quot;images/switch-loading.gif&quot; /&gt;&#39;);
				$.ajax({
				type : &#39;POST&#39;,
				url : &#39;funcoes/enquete_adm.php&#39;,
				dataType : &#39;json&#39;,
				data: {key:key,title:title,opcao1:opcao1,opcao2:opcao2,opcao3:opcao3,opcao4:opcao4,opcao5:opcao5,opcao6:opcao6},
				success : function(data){
					if(data.sql == &#39;ok&#39;){
							$(&#39;#resposta&#39;).addClass(&#39;success-box&#39;).html(&#39;Enquete Salva!&#39;).fadeIn(1000);
							$(&#39;#control&#39;).fadeOut();
						}else if(data.sql == &#39;error&#39;){
							$(&#39;#resposta&#39;).addClass(&#39;info-box&#39;).html(&#39;Ops, aconteceu um erro. Por favor, tente novamente&#39;).fadeIn(1000);
						}
					},
				error: function (XMLHttpRequest, textStatus, errorThrown) {    
					alert(&quot;XMLHttpRequest &quot; + XMLHttpRequest[0]);alert(&quot; errorThrown: &quot; + errorThrown);alert( &quot; textstatus : &quot; + textStatus);    
				}
				});
			}else{
				$(&#39;#resposta&#39;).addClass(&#39;warning-box&#39;).html(&#39;&#201; necess&#225;rio no m&#237;nimo duas op&#231;&#245;es&#39;);
			};
		}else{
			$(&#39;#resposta&#39;).addClass(&#39;warning-box&#39;).html(&#39;Coloque a pergunta da enquete&#39;);
		};
		return false;
		
	});
    }); // End





syntax error: unexpected token &lt;

My SPA application uses the following architecture ([source](https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/)):

[![enter image description here][1]][1]

This assumes that my client application knows about the refresh token, because I need it to request a new access token if no user credentials (e.g. email/password) are present.

My question: **Where do I store the refresh token in my client-side application?** There are lots of questions/answers about this topic on SO, but regarding the refresh token the answer are not clear.

Access token and refresh token shouldn&#39;t be stored in the local/session storage, because they are not a place for any sensitive data. Hence I would store the **access token** in a `httpOnly` cookie (even though there is CSRF) and I need it for most of my requests to the Resource Server anyway.

**But what about the refresh token?** I cannot store it in a cookie, because (1) it would be send with every request to my Resource Server as well which makes it vulnerable to CSRF too and (2) it would send expose both access/refresh token with an identical attack vector.

There are three solutions I could think of:

___

1) Storing the refresh token in an in-memory JavaScript variable, which has two drawbacks: 

* a) It&#39;s vulnerable to XSS (but may be not as obvious as local/session storage
* b) It looses the &quot;session&quot; if a user closes the browser tab

Especially the latter drawback makes will turn out as a bad UX.

___

2) Storing the access token in session storage and sending it via a `Bearer access_token` authorization header to my resource server. Then I can use `httpOnly` cookies for the refresh token. This has one drawback that I can think of:

* a) The refresh token is exposed to CSRF with every request made to the Resource Server. 

___

3) Keep both tokens in `httpOnly` cookies which has the mentioned drawback that both tokens are exposed to the same attack vector.

___

Maybe there is another way or more than my mentioned drawbacks (please let me know), but in the end everything boils down to **where do I keep my refresh token on the client-side**? Is it `httpOnly` cookie or an in-memory JS variable? If it is the former, where do I put my access token then? 

Would be super happy to get any clues about how to do this the best way from people who are familiar with the topic.


  [1]: https://i.stack.imgur.com/BPJjA.png

Where to store the refresh token on the Client?

I have one file request.js which contains wrapper for axios ajax request. I am calling request function from multiple react components and when one of the request fails I want to refresh the token and retry all the failed requests again. I can use intercepters, but I don&#39;t know how to implement it. Please help.

request.js

     var client = axios.create({
       baseURL: &#39;http://192.168.1.3:3000&#39;,
         headers: {
         appID: 8,
         version: &quot;1.1.0&quot;,
         empID: localStorage.getItem(&#39;empID&#39;),
         token: localStorage.getItem(&#39;accessToken&#39;)
        }
     });

     const request = function(options) {
         const onSuccess = function(response) {
             console.debug(&#39;Request Successful!&#39;, response);
             return response.data;
         } 
         const onError = function(error) {
             console.error(&#39;Request Failed:&#39;, error.config);
             if (error.response) {
                 console.error(&#39;Status:&#39;,  error.response.status);
                 console.error(&#39;Data:&#39;,    error.response.data);
                 console.error(&#39;Headers:&#39;, error.response.headers);
             } else {
                 console.error(&#39;Error Message:&#39;, error.message);
             }

             return Promise.reject(error.response || error.message);
         }

         return client(options)
             .then(onSuccess)
             .catch(onError);
             options
     }

     export default request;

How to handle 401 (Authentication Error) in axios and react?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. 

I have the idea below to handle above 2 cases by hitting the user database. 

1.Incase of password changes, I check for password(hashed) stored in the user db.

2.Incase of logout, I save last-logout time in user db, hence by comparing the token created time and logout time, I can able to invalidate this case.

But these 2 cases comes at the cost of hitting user db everytime when the user hits the api. Any best practise is appreciated.


**UPDATE:**
 I dont think we can able to invalidate JWT without hitting db. So I came up with a solution. I have posted my answer, if you have any concern, you are welcome.

Best practices to invalidate JWT while changing passwords and logout in node.js?

I&#39;m trying to use Apache Lucene for tokenizing, and I am baffled at the process to obtain Tokens from a `TokenStream`.

The worst part is that I&#39;m looking at the comments in the JavaDocs that address my question.

http://lucene.apache.org/java/3_0_1/api/core/org/apache/lucene/analysis/TokenStream.html#incrementToken%28%29

Somehow, an `AttributeSource` is supposed to be used, rather than `Token`s.  I&#39;m totally at a loss.  

Can anyone explain how to get token-like information from a TokenStream?

How to get a Token from a Lucene TokenStream?

To reset the admin password of SolusVM I am executing [the following command][1]:

    php /usr/local/solusvm/scripts/pass.php --type=admin --comm=change --username=&lt;ADMINUSERNAME&gt;

When doing so, the following error message is printed:

    -bash: syntax error near unexpected token `newline&#39;

What is the reason for this problem? I am running the command as root.


  [1]: https://documentation.solusvm.com/display/DOCS/Generate+New+Admin+Password

-bash: syntax error near unexpected token `newline&#39;

I am trying to perform a Post to my WebAPI from a c# WPF desktop app.

No matter what I do, I get 

&gt; {&quot;error&quot;:&quot;unsupported_grant_type&quot;}

This is what I&#39;ve tried (and I&#39;ve tried everything I could find):

Also dev web api currently active for testing: http://studiodev.biz/

base http client object:

    
    var client = new HttpClient()
    client.BaseAddress = new Uri(&quot;http://studiodev.biz/&quot;);
    client.DefaultRequestHeaders.Accept.Clear();
    client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(&quot;application/json&quot;));
    client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(&quot;text/plain&quot;));
    client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(&quot;*/*&quot;));

with the following send methods:

    var response = await client.PostAsJsonAsync(&quot;token&quot;, &quot;{&#39;grant_type&#39;=&#39;password&#39;&amp;&#39;username&#39;=&#39;username&#39;&amp;&#39;password&#39;=&#39;password&#39;&quot;);
    var response = await client.PostAsJsonAsync(&quot;token&quot;, &quot;grant_type=password&amp;username=username&amp;password=password&quot;);

After that failed, I did some googling and tried:

    LoginModel data = new LoginModel(username, password);
    string json = JsonConvert.SerializeObject(data);
    await client.PostAsync(&quot;token&quot;, new JsonContent(json));
 same result, so I tried:
                    
    req.Content = new StringContent(json, Encoding.UTF8, &quot;application/x-www-form-urlencoded&quot;);
    await client.SendAsync(req).ContinueWith(respTask =&gt;
    {
     Application.Current.Dispatcher.Invoke(new Action(() =&gt; { label.Content = respTask.Result.ToString(); }));
    });

Note: I can make a successful call with Chrome.

**Update Fiddler Result**

![enter image description here][1]

Could someone please help me make a successful call to the above web api...
Please let me know if I can help clarify.
Thanks!!


  [1]: http://i.stack.imgur.com/qZ9oV.jpg

C# unsupported grant type when calling web api

I have a script that delete and re-create jobs through curl HTTP-calls and I want to get rid of any hard-coded &quot;username:password&quot;.
E.g. `curl -X POST $url --user username:password`

Considerations:

 - **Jenkins CLI** (probably not an option). 
One should be able to achieve the same with the CLI as with Jenkins API (creating jobs etc) but as far as I understand Jenkins CLI is not a good alternative for me since jobs created with will only appear in Jenkins after restarting or a &quot;Reload Configuration from Disk&quot;, and that would cancel any other running jobs.

 - **API token**. Can&#39;t find out how to get the user token and then pass it
   as a parameter to the script, but that may be a solution..

How can a Jenkins user authentication details be &quot;passed&quot; to a script which uses Jenkins API to create jobs?

I am considering to use JWT. In the [jwt.io example](https://jwt.io/) I am seeing the following information in the payload data:

    &quot;admin&quot;: true

Admin can be considered as a Role, hence my question. Is setting the role in the token payload a habitual/good practice? Given that roles can be dynamically modified, I&#39;m quite interrogative.

Is setting Roles in JWT a best practice?

I implemented the oauth2 web flow in order to get access_token from users of my app. With the access_token, I would like to do the following actions:  

1. Get user informations  
2. Create a repo for this user  
3. Push code to this repo (using git push &lt;remote&gt; &lt;branch&gt;)

I already successfully get the user information(1) and create a repo(2)

The problem is I can&#39;t push code (3), I got &quot;Unauthorized&quot; error.  


The command I run:


    git remote add origin https://gitlab-ci-token&lt;mytoken&gt;@gitlab.com/myuser/myrepo.git  
    git push origin master


gitlab - Push to a repository using access_token

I&#39;m trying to compile the NIST Biometric Image Software, and I have been having trouble all day. I finally got the source checked out right, and I installed cygwin with no problems (I have used it in the past), but when I went to compile, I get this error:

     $  sh setup.sh &lt;/cygdrive/c/NBIS&gt; [--without-X11]
     setup.sh: line 94: syntax error near unexpected token `$&#39;in\r&#39;&#39;
     &#39;etup.sh: line 94: `    case $1 in

Now I&#39;m sure any advanced coder would head to the setup.sh and look for problems, but I&#39;m not really much of a coder (I&#39;m only compiling this because there are no pre-compiled packages) so I don&#39;t know what to do. I didn&#39;t install any libraries with cygwin, I just left everything default. I&#39;m trying to follow the NBIS manual, but I don&#39;t really understand it that well and so I&#39;m struggling badly. Maybye taking a look at it you may notice something I missed: http://www.nist.gov/customcf/get_pdf.cfm?pub_id=51097

syntax error near unexpected token `$&#39;in\r&#39;&#39;

Is it safe to use the `remember_token` in the users table for authenticating the user into the application?

What is the purpose of this token? Currently, I&#39;m using it in forms to check whether the user is logged in - if the token is not present, I show the login screen. Each time the user logs out, this token is regenerated.

Laravel: What is &quot;remember_token&quot; in the &quot;users&quot; DB table?

I have a conflict when using System.IdentityModel.Tokens :

    using System;
    using System.Configuration;
    using System.Data;
    using System.Data.SqlClient;
    using System.IdentityModel.Tokens;
    using System.IdentityModel.Tokens.Jwt;
    using System.Text;

    public voidGenereToken()
    {
        const string sec = &quot;401b09eab3c013d4ca54922bb802bec8fd5318192b0a75f201d8b3727429090fb337591abd3e44453b954555b7a0812e1081c39b740293f765eae731f5a65ed1&quot;;
        var now = DateTime.UtcNow;
        var securityKey = new InMemorySymmetricSecurityKey(Encoding.Default.GetBytes(sec));
        var signingCredentials = new SigningCredentials(securityKey,
                SecurityAlgorithms.RsaSha256Signature, SecurityAlgorithms.Sha256Digest);

        var header = new JwtHeader(signingCredentials);

        var payload = new JwtPayload
        {
            {&quot;iss&quot;, &quot;a5fgde64-e84d-485a-be51-56e293d09a69&quot;},
            {&quot;scope&quot;, &quot;https://example.com/ws&quot;},
            {&quot;aud&quot;, &quot;https://example.com/oauth2/v1&quot;},
            {&quot;iat&quot;, now},
        };

        var secToken = new JwtSecurityToken(header, payload);

        var handler = new JwtSecurityTokenHandler();
        var tokenString = handler.WriteToken(secToken);
        Console.writeLine(tokenString)
    }

I get following error when I create header (*var header = new JwtHeader(signingCredentials);*) :

&gt; Argument type &#39;System.IdentityModel.Tokens.SigningCredentials&#39; is not
&gt; assignable to parameter type
&gt; &#39;Microsoft.IdentityModel.Tokens.SigningCredentials&#39;

I don&#39;t understand because all my type refers to *System.IdentityModel.Tokens*.
and in documentation [JwtHeader Constructor][1] need *System.IdentityModel.Tokens.SigningCredentials*

I don&#39;t know what&#39;s wrong ... 

  [1]: https://msdn.microsoft.com/en-us/library/dn451132(v=vs.114).aspx

Conflict between System.IdentityModel.Tokens and Microsoft.IdentityModel.Tokens

I want to save/persist/preserve a cookie or localStorage token that is set by a **cy.request()**, so that I don&#39;t have to use a custom command to login on every test. This should work for tokens like **jwt** (json web tokens) that are stored in the client&#39;s localStorage. 



Preserve cookies / localStorage session across tests in Cypress

what tokens do you find useful in visual studio?
(*visual studio 2010* → **environment** → **task list** → tokens)

currently i have only:

 - **HACK** - *low*
 - **REVIEW - high**
 - **TODO** - normal
 - **WTF - high**

(only these - deleted some default ones)

**are you using any others?**

**are you covering any other important thing with comment tokens?**

any best practices? thnx

tokens in visual studio: HACK, TODO... any other?

I have an unusual use-case I&#39;m trying to code for.  The goal is this: I want the customer to be able to provide a string, such as:

    &quot;cars.honda.civic = On&quot;

Using this string, my code will set a value as follows:

    $data[&#39;cars&#39;][&#39;honda&#39;][&#39;civic&#39;] = &#39;On&#39;;

It&#39;s easy enough to tokenize the customer input as such:

    $token = explode(&quot;=&quot;,$input);
    $value = trim($token[1]);
    $path = trim($token[0]);
    $exploded_path = explode(&quot;.&quot;,$path);

But now, how do I use $exploded path to set the array without doing something nasty like an eval?

Using a string path to set nested array data

I&#39;m designing a web site that will have a mobile companion (initally iPhone only). The web site will be an ASP.Net MVC 3 application. I&#39;ll also have an ASP.Net Web API site (MVC 4) to expose services to the iPhone application. The iPhone app will have its own form to capture username and password from the user and send that to the web API in JSON headers.

I want to consider security from the start rather than an after thought. *I&#39;m not a security expert by any means.* I&#39;ve done a good deal of research to see how other&#39;s are handling authentication of a mobile application client from a web service. I think I&#39;ve come up with a decent solution that doesn&#39;t involve hooking into to third party oAuths.

I would greatly appreciate any and all opinions, advice, criticism and general WTFs that any of you can offer. :)

My biggest concerns are:
&lt;ol&gt;
&lt;li&gt;Ensuring that calls made to the web API are authorized&lt;/li&gt;
&lt;li&gt;Minimizing the risk of replay attacks (hence timestamps in the calls below)&lt;/li&gt;
&lt;/ol&gt;

The iPhone app will be developed as such:&lt;br&gt;
*Two strings are hard-coded into the iPhone app (same values for every user):*
&lt;ol&gt;
&lt;li&gt;&lt;b&gt;Application ID&lt;/b&gt;&lt;br&gt;This is a string that is used to identify the type of client that is accessing the web API (iPhone, Android, Windows phone, etc).&lt;/li&gt;&lt;br&gt;
&lt;li&gt;&lt;b&gt;Application&#39;s Hashing Salt&lt;/b&gt;&lt;br&gt;This is a string that is used to salt hashes for user-agnostic requests.&lt;/li&gt;
&lt;/ol&gt;
*Two strings are stored in the iPhone app&#39;s local database (values unique to each user):*
&lt;ol&gt;
&lt;li&gt;&lt;b&gt;API User Access Token&lt;/b&gt;&lt;br&gt;This is a string (token) provided to the client by the web API upon successful authentication and allows the client to access the web API without sending the username and password in each request.&lt;br&gt;&lt;/li&gt;

&lt;li&gt;&lt;b&gt;User&#39;s Hashing Salt&lt;/b&gt;&lt;br&gt;This is a string that is used to salt hashes for requests made against established user accounts.&lt;/li&gt;
&lt;/ol&gt;
&lt;br&gt;
&lt;br&gt;
The iPhone will make calls to the web API in the following manner:&lt;br&gt;&lt;br&gt;
&lt;b&gt;API Method: Create Account&lt;/b&gt;&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;New Account Data (Username, Password, First Name, Last Name, etc..)&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID salted with Application&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
API Returns:
&lt;ul&gt;
&lt;li&gt;New User&#39;s Hashing Salt&lt;br&gt;&lt;br&gt;The idea here is that, when creating an account, I can use the application&#39;s hardcoded salt since it&#39;s not a huge security risk if that salt ever got out (through decompilation or some other means).&lt;br&gt;&lt;br&gt;
But for methods that access and modify the user&#39;s data I&#39;ll use a salt that is owned only by that user so it can&#39;t be used by an attacker to impersonate others.&lt;/li&gt;
&lt;/ul&gt;
&lt;br&gt;
&lt;b&gt;API Method: Get Account&lt;/b&gt;&lt;br&gt;(Used for getting user&#39;s hashing salt for accounts that were created on the web site but haven&#39;t yet been synced on the iPhone. This happens when a user tries to log in on the iPhone and iPhone detects that it has no record for that username.)&lt;br&gt;
&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;Username&lt;/li&gt;
&lt;li&gt;Password (hashed with Application&#39;s Hashing Salt)&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID salted with Application&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
API Returns:
&lt;ul&gt;
&lt;li&gt;Existing User&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
&lt;br&gt;
&lt;b&gt;API Method: Log In (Authenticate)&lt;/b&gt;&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;Username&lt;/li&gt;
&lt;li&gt;Password (hashed with User&#39;s Hashing Salt)&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID salted with User&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;
API Returns:
&lt;ul&gt;
&lt;li&gt;API User Access Token&lt;/li&gt;
&lt;/ul&gt;
&lt;br&gt;
&lt;b&gt;API Method: Any Command (i.e. Create Post, Update Profile, Get Messages, etc...)&lt;/b&gt;&lt;br&gt;
Client Sends:
&lt;ul&gt;
&lt;li&gt;Command Data&lt;/li&gt;
&lt;li&gt;API User Access Token&lt;/li&gt;
&lt;li&gt;Application ID&lt;/li&gt;
&lt;li&gt;UTC Timestamp&lt;/li&gt;
&lt;li&gt;Hash of UTC Timestamp + Application ID + API User Access Token salted with User&#39;s Hashing Salt&lt;/li&gt;
&lt;/ul&gt;

Authenticating requests from mobile (iPhone) app to ASP.Net Web API (Feedback requested on my design)

I&#39;m building a .net core web api.

Preface - I&#39;ve implemented token authentication as per https://stormpath.com/blog/token-authentication-asp-net-core and https://dev.to/samueleresca/developing-token-authentication-using-aspnet-core. I&#39;ve also read a few issues on github and here on SO.

This also came in handy https://goblincoding.com/2016/07/24/asp-net-core-policy-based-authorisation-using-json-web-tokens/.

After implementing it all I&#39;m feeling like I&#39;m missing something.

I&#39;ve created a simple Angular application that sits in a web client. When I authenticate, client is sent a token. I&#39;m storing that in session for now (still in dev so will address security concerns around where to store it later).

Not really sure this (https://stackoverflow.com/questions/26739167/jwt-json-web-token-automatic-prolongation-of-expiration) is useful as I haven&#39;t implemented refresh tokens as far as I can see.

I noticed that when I call logout, and then log back in again, the client is sent a new token - as expected. However, if the token expiry time is passed (I set it to 1 minute for testing) and then the page is refreshed, the token seems to remain the same in my app. **i.e. it&#39;s as if the token never expires?!**

**I would have expected the client to be returned a 401 Unauthorised error and I can then handle forcing the user to re-authenticate.**

**Is this not how this should work?** Is there some auto-refresh token magic going on in the background that is default (I haven&#39;t set up any notion of refresh tokens in the tutorials explicitly)? Or am I missing something about the concept of token auth?

Also - **if this is a perpetually refreshing token, should I be concerned about security if the token was ever compromised?**

Thanks for your help


All Token Solutions on Gang of Coders

Total of 40 Token Solutions