Hot answers tagged

2

Using $$token = SHA256(APIKey \mathbin\| SecretKey \mathbin\| expireTimestamp) \mathbin\| expireTimestamp$$ is not secure since it can cause a length extension attack as; $$token2 = SHA256(APIKey \mathbin\| SecretKey \mathbin\| expireTimestamp \| \color{red}{extension}) \mathbin\| (expireTimestamp \| \color{red}{extension}) $$ This is a valid token for the ...


Only top voted, non community-wiki answers of a minimum length are eligible