安全令牌的长度
我正在使用安全令牌创建不可猜测的 URL，如下所示（16 字节，十六进制）
http://example.com/something/private/b5f8c21a628e12b39786fb8ef9561d31
该令牌类似于共享密码：谁知道该 URL 是否允许访问该资源。
对于安全 URL 来说，安全随机值必须多少字节才合适？
I'm using security tokens to create not guessable URLs like this (16 bytes, hex)
http://example.com/something/private/b5f8c21a628e12b39786fb8ef9561d31
The token is something like a shared passwords: Who knows the URL is allowed to access the resource.
How many bytes should a secure random value have to be appropriate for secure URLs?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我最终得到了一个 64 位随机值，该值被编码为 url 安全的 Base64。猜测正确标记的可能性是
1 / 2^64等于1 / 18446744073709551616。这是一个相当令人印象深刻的数字，攻击者几乎不可能通过 http 请求找到正确的令牌。网址现在如下所示：
http://example.com/private/1oWYPiqO81k/I've ended up with a 64 Bit random value which is encoded as url-safe Base64. The possibility to guess the correct token is
1 / 2^64what is equal to1 / 18446744073709551616. This is a pretty impressive number and it would be nearly impossible for an attacker to find the correct token with http requests.URLs look like this now:
http://example.com/private/1oWYPiqO81k/所有应用程序在某些时候都依赖于加密随机数。毕竟这是一个会话 id 或 csrf 令牌值。这里的重要性在于，如果攻击者有 100 年的时间来打破它，那么该值有多长并不重要。 100 年是一段很长的时间，但你应该努力让你的设计能够持续这么久。
Cookie 与您的值在安全性方面的主要区别在于 Cookie 会在每次使用时过期并发生变化。但实际上，应该不惜一切代价避免这个值。如果这用于身份验证，则依赖会话 ID，这就是它存在的原因。不要滚动自己的会话。
Well all applications depend on a cryptographic nonce at some point. After all this is a session id or csrf token value. The importance here is that it doesn't matter how long the value is if the attacker has 100 years to break it. Now 100 years is a long time, but you should strive for your designs to last this long.
The main difference in security between a cookie and your value is that the cookie expires and changes for every use. But in all reality this value should be avoided at all costs. If this is used for authentication, then rely on the session id, that's why its there. Don't roll your own session.
例如，10 个 unicode 字符 URL 实际上是不可能猜测的，因为令牌有 160 位长，因此有 2^160 种不同的可能 URL。但是，您不应该依赖类似的安全性，而应该依赖经典的登录和身份验证
10 unicode characters URLs for example, are pratically impossible to guess because tokens are 160 bits long and thus there are 2 ^ 160 different possible URLs. However you shouldn't rely on something like that for security, but on classical login and auth