I'm trying to find a good algorithm for generating authorization codes, access tokens and refresh tokens in an API.
Currently, I am looking into the following setup:
Tokens are generated using the
RNGCryptoServiceProvider class in C#. (I have limited the allowed chars to the following set:
Authorization codes are generated with 256-bit length and have a lifetime of 5 minutes. Access tokens are generated with 512-bit length and have a lifetime of 1 hour. Refresh tokens are generated with 2048-bit length and have a lifetime of 60 days.
Those codes and tokens are then salted with a random 64-bit salt, and then hashed using
SHA-256 before being stored in the database.
Considering the token lifetime, salt and hashing algorithm used, would this be a reasonable secure setup?