如何在python中生成唯一的身份验证令牌？

Question

I am trying to write a token based auth in flask for my android app. For that I need a unique token using which I can verify the user.

Itsdangerous library provide a JSONWebSignatureSerializer function using which I can create JWT token. So my first question is, is it safe to use JWT for mobile based auth ?

Secondly, I did a little bit research on how django rest framework generates its token.

def generate_key(self):
    return binascii.hexlify(os.urandom(20)).decode()  

Is this token unique or just a random one? Which one should I use for a mobile based auth?

What is the based way to generate a unique token for mobile application in python ?

Answer 1

You can use like as mentioned the builtin uuid module. The new secrets module released in 3.6 is also capable of creating unique tokens also.

from uuid import uuid4

rand_token = uuid4()

The function below creates a unique token every time it's called. The os.urandom method returns 20 random bytes as a string and the binascii.hexlify method converts each of those 20 bytes into 2-digit hex representation of that byte. This is why the return value is twice as long.

If you want to use this approach and need tokens to be specific length, use half of the length you need as an argument to the os.urandom method.

def generate_key(self):
    return binascii.hexlify(os.urandom(20)).decode()

Answer 2

OK, this is old, but I'm chiming in anyway. You need to decide: Do you want unique or random? Choose one.

If you want unique, use UUID. The whole purpose of UUIDs is to make sure you generate something that's unique. UUID stands for Universally Unique ID.

If you want something that's random, use os.urandom . Truly random results cannot be limited to uniqueness constraints! That'd make them not random. Indeed, it'd make them UUIDs.

Now, for your question, you're asking for an auth token. That means you're using this for security purposes. UUIDs are the wrong solution and generating a secure number is the right one. Could you have a collision when generating a random number instead of a UUID? Yes. But it's unlikely unless you've got a gazillion users. You'll want to do your math on this, but my recommendation is: Don't use UUID when you mean to use random.

Oy.

Answer 3

Look at the uuid() library. Docs are here:

https://docs.python.org/2/library/uuid.html

and a previous discussion of the question is here:

How to create a GUID/UUID in Python

with lots of good details.

Answer 4

I wrote a little helper function for generating a unique token in django models. You can call it from the save() method of your model. It generates a candidate token using a defined function, searches the existing rows in the database for that candidate token. If it finds one, it trys again, otherwise, it returns the candidate string. Note that there is a small race condition in this, but is unlikely to occur with a token function with a sufficiently large range of outputs.

def generate_unique_token(Model,
                      token_field="token",
                      token_function=lambda: uuid.uuid4().hex[:8]):
"""
Generates random tokens until a unique one is found
:param Model: a Model class that should be searched
:param token_field: a string with the name of the token field to search in the model_class
:param token_function: a callable that returns a candidate value
:return: the unique candidate token
"""
unique_token_found = False
while not unique_token_found:
    token = token_function()
    # This weird looking construction is a way to pass a value to a field with a dynamic name
    if Model.objects.filter(**{token_field:token}).count() is 0:
        unique_token_found = True
return token

Then, you can find a unique token simply by calling

token = generate_unique_token(MyModelInstance, "token_field_name")

It even supports using other methods of generating tokens. For example, if you want to use the full uuid, you can simply call it like this:

token = generate_unique_token(MyModel, "token_field_name", lambda: uuid.uuid4().hex)

Answer 5

一个可能的解决方案是 AES 加密令牌过期的时间 ​​+ 用户名，这使得发现过期令牌变得相当容易，并且不需要额外的令牌数据库空间