Login Tokens

(Difference between revisions)
Jump to: navigation, search
(→Boas Práticas)
Line 3: Line 3:
 
=== login_token ===
 
=== login_token ===
  
−
É o token gerado a cada login social feito pelo usuário.  
+
It is the token generated each time a visitor performs a social login.
  
−
É fornecido no evento [[socialid.events.onLoginSuccess]] ou enviado como parâmetro ao callback url cadastrado no Social Login.
+
This is returned on the [[socialid.events.onLoginSuccess]] event or sent as a parameter to the callback url configured on the Social Login application.
  
−
Características:
+
Characteristics:
−
* Atualiza: a cada login social
+
* Updates: every time the user logs in.
−
* Validade: expira em 1 hora
+
* Validity: expires in 1 hour.
  
 
APIs:
 
APIs:
−
* É usado para autenticação da API [[GET login/info]].
+
* It's used to authenticate the [[GET login/info]] API call.
  
 
=== connection_id ===
 
=== connection_id ===
  
−
É um identificador gerado para cada conexão ativa do usuário. Representa a sessão do usuário no Social Login.  
+
It is an identifier generated for each visitors' active connection. It represents the Social Login session for the current visitor.
  
−
Os Widgets do Social Login automaticamente identificam usuários logados dado o connection_id salvo como cookie no browser do usuário.
+
The Social Login widgets automatically identify users logged in given the connection_id saved on a cookie on the visitor's browser.
  
−
Características:
+
Characteristics:
−
* Atualiza: a cada login social ou via API
+
* Updates: every time the user logs in or using an API call.
−
* Validade: expira em 15 dias
+
* Validity: expires in 15 days.
  
 
APIs:
 
APIs:
−
* É possível gerar um novo connection_id dado um id de usuário usando a API REST [[POST login/apps/:app_id/sign_ins]].
+
* It's possible to generate a new connection_id given a user id using the [[POST login/apps/:app_id/sign_ins]] REST API.
−
* Dado um connection_id, é possível logar um usuário na sessão do Social Login usando a API Javascript [[socialid.login.loginConnection]].
+
* Given a connection_id, it's possible to log in a user on a Social Login session using the [[socialid.login.loginConnection]] JavaScript API.
−
* Para deslogar um usuário da sessão do Social Login use a API Javascript [[socialid.login.logout]] ou a API REST [[DELETE login/connections/:id]]
+
* To log off a user from a Social Login session, use the [[socialid.login.logout]] JavaScript API or the [[DELETE login/connections/:id]] REST API.
  
 
=== user_token ===
 
=== user_token ===
  
−
É um token que serve para identificar o usuário. É usado em algumas APIs Javascript para identificar o usuário de forma segura.
+
It is a token used in a few JavaScript APIs to identify the user in a secure way.
  
−
Características:
+
Characteristics:
−
* Atualiza: a cada login social ou via API
+
* Updates: every time the user logs in or via API.
−
* Validade: não expira
+
* Validity: never expires.
  
 
APIs:
 
APIs:
−
* A API [[PUT login/users/:user_id/token]] atualiza o token de um usuário.
+
* The [[PUT login/users/:user_id/token]] API updates a user's token.
−
* Dado um user_token, é possível logar um usuário na sessão do Social Login (gerando um novo connection_id) usando a API Javascript [[socialid.login.loginUserToken]].
+
* Given a user_token, it's possible to log in a user on a Social Login session (generating a new connection_id) using the [[socialid.login.loginUserToken]] JavaScript API.
  
−
== Segurança da Informação ==
+
== Security ==
  
−
As APIs REST utilizam o protocolo de autenticação HTTP Basic. Veja a documentação de [[Authentication|autenticação]].
+
The REST APIs use the HTTP Basic protocol for authentication. See the [[Authentication]] documentation.
  
−
As APIs Javascript utilizam a sessão do usuário atualmente logado no Social Login ou identificadores como connection_id e user_token como parâmetros de autenticação.  
+
The JavaScript APIs use the session of the user currently logged in Social Login or identifiers like connection_id and user_token as authentication parameters.
  
−
APIs Javascript precisam de um cuidado redobrado em termos de segurança da informação pois são usadas no browser do usuário (ex: não é possível garantir validade de código Javascript) e em condições desconhecidas (ex: redes Wi-Fi públicas não encriptadas). Assim como qualquer sessão de browser, as APIs Javascript estão sujeitas a ataques de [http://en.wikipedia.org/wiki/Session_hijacking Session Hijacking] ou [http://en.wikipedia.org/wiki/Man-in-the-middle_attack Man-in-the-middle], dentre vários outros.
+
JavaScript APIs required a bigger effort to ensure security because they are used on the visitor's browser (i.e. it's not possible to guarantee JavaScript code validity) and in unpredictable conditions (i.e. in public, non-encripted Wi-Fi networks). As with any browser session, JavaScript APIs may be subject to [http://en.wikipedia.org/wiki/Session_hijacking Session Hijacking] or [http://en.wikipedia.org/wiki/Man-in-the-middle_attack Man-in-the-middle], among others.
  
−
A fim de minimizar riscos de segurança, listamos algumas boas práticas a seguir. O desenvolvedor que está integrando nossas APIs precisa estar ciente que o uso indiscriminado dos identificadores connection_id e user_token pode levar a riscos de segurança.
+
To minimize security risks, we show below a list of good practices. Developers using our APIs need to be aware that the indiscriminate use of connection_id and user_token identifiers may increase those risks.
  
−
=== Boas Práticas ===
+
=== Good Practices ===
  
−
* Deslogue o usuário do Social Login sempre que ele se deslogar da sua aplicação. Use a API Javascript [[socialid.login.logout]] ou a API REST [[DELETE login/connections/:id]].
+
* Log off the user from Social Login every time he logs off your application. Use the [[socialid.login.logout]] JavaScript API or the [[DELETE login/connections/:id]] REST API.
  
−
* Atualize o user_token periodicamente usando a API REST [[PUT login/users/:user_id/token]]. Como o user_token não expira e pode ser usado em APIs JS críticas (ex: logar ou mover usuários), é recomendável mudar o token periodicamente para evitar [http://en.wikipedia.org/wiki/Session_hijacking Session Hijacking].
+
* Update user_token periodically using the [[PUT login/users/:user_id/token]] REST API. As the user_token doesn't expires and may be used on critical JavaScript APIs (e.g. to log in or move users), it's advisable to update this token periodically to avoid [http://en.wikipedia.org/wiki/Session_hijacking Session Hijacking].
  
−
* Use conexão segura ([http://en.wikipedia.org/wiki/Https HTTPS]) em seu site para trafegar os dados e impedir que os tokens sejam interceptados por atacantes em redes desprotegidas. Veja [http://en.wikipedia.org/wiki/Man-in-the-middle_attack Man-in-the-middle attack].
+
* Use secure connections ([http://en.wikipedia.org/wiki/Https HTTPS]) on your website to avoid tokens to be intercepted by attackers on unprotected networks. See [http://en.wikipedia.org/wiki/Man-in-the-middle_attack Man-in-the-middle attack].
  
−
* Evite armazenar qualquer token em Cookies. Caso o faça, use o atributo "[http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly secure]" do Cookie.
+
* Avoid storing any token in cookies. If you must do it, use the "[http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly secure]" attribute on the cookie.
  
−
* Use as [[RESTful APIs|APIs REST]] apenas no backend, nunca via Javascript (frontend). O API ID e API Secret usado na [[Authentication|autenticação]] das mesmas não deve ser exposto no browser dos usuários.
+
* Use [[RESTful APIs]] only on backend, never via JavaScript (frontend). The API ID and Secret that are used as [[Authentication]] must not be exposed on users's browsers.
  
−
* Utilize uma autenticação extra (ex: login tradicional com login e senha) em operações críticas em seu site (ex: operações financeiras, gerenciamento de cartão de crédito, etc).
+
* Use extra authentication (e.g. login / password authentication) in critical operations on your website (financial operations, credit card data management, etc).

Revision as of 17:45, 3 November 2014

Contents

Tokens

login_token

It is the token generated each time a visitor performs a social login.

This is returned on the socialid.events.onLoginSuccess event or sent as a parameter to the callback url configured on the Social Login application.

Characteristics:

  • Updates: every time the user logs in.
  • Validity: expires in 1 hour.

APIs:

connection_id

It is an identifier generated for each visitors' active connection. It represents the Social Login session for the current visitor.

The Social Login widgets automatically identify users logged in given the connection_id saved on a cookie on the visitor's browser.

Characteristics:

  • Updates: every time the user logs in or using an API call.
  • Validity: expires in 15 days.

APIs:

user_token

It is a token used in a few JavaScript APIs to identify the user in a secure way.

Characteristics:

  • Updates: every time the user logs in or via API.
  • Validity: never expires.

APIs:

Security

The REST APIs use the HTTP Basic protocol for authentication. See the Authentication documentation.

The JavaScript APIs use the session of the user currently logged in Social Login or identifiers like connection_id and user_token as authentication parameters.

JavaScript APIs required a bigger effort to ensure security because they are used on the visitor's browser (i.e. it's not possible to guarantee JavaScript code validity) and in unpredictable conditions (i.e. in public, non-encripted Wi-Fi networks). As with any browser session, JavaScript APIs may be subject to Session Hijacking or Man-in-the-middle, among others.

To minimize security risks, we show below a list of good practices. Developers using our APIs need to be aware that the indiscriminate use of connection_id and user_token identifiers may increase those risks.

Good Practices

  • Update user_token periodically using the PUT login/users/:user_id/token REST API. As the user_token doesn't expires and may be used on critical JavaScript APIs (e.g. to log in or move users), it's advisable to update this token periodically to avoid Session Hijacking.
  • Use secure connections (HTTPS) on your website to avoid tokens to be intercepted by attackers on unprotected networks. See Man-in-the-middle attack.
  • Avoid storing any token in cookies. If you must do it, use the "secure" attribute on the cookie.
  • Use RESTful APIs only on backend, never via JavaScript (frontend). The API ID and Secret that are used as Authentication must not be exposed on users's browsers.
  • Use extra authentication (e.g. login / password authentication) in critical operations on your website (financial operations, credit card data management, etc).
Retrieved from "https://dev.socialidnow.com/index.php?title=Login_Tokens&oldid=1296"
Personal tools
Namespaces
Variants
Actions
Navigation
Toolbox