https URL with token parameter : how secure is it?
On our site, we provide to users a simulation based on their private information (given through a form). We would like to allow them to get back on their simulation results later, but without forcing them to create a login/password account.
We have thought of sending them an email with a link, from which they could get back their results. But, naturally, we have to secure this URL, because private data is at stake.
So we're intending to pass a token (like a 40 characters combination of letters and digit, or a MD5 Hash) in the URL and to use SSL.
Finally, they would receive an email like that:
Hi,
Get back your results on https://www.example.com/load_simulation?token=uZVTLBCWcw33RIhvnbxTKxTxM2rKJ7YJrwyUXhXn
What do you think about it? Is it secure enough? What would you advise me for the token generation? What about passing URL parameters in a https request?
SSL will protect the query parameters in transit; however, email itself is not secure, and the email could bounce along any number of servers before getting to its destination.
Also depending on your web server the full URL might get logged in its log files. Depending on how sensitive the data is you might not want your IT people having access to all the tokens.
Additionally the URL with the query string would be saved in your user's history, allowing other users of the same machine to access the URL.
Finally and what makes this very insecure is, the URL is sent in the Referer header of all requests for any resource, even third party resources. So if you're using Google Analytics for example, you will send Google the URL token in and all to them.
In my opinion this is a bad idea.
I'd use a cookie for that. The workflow should be like this:
- User comes to your site for the first time.
- Site sets a cookie
- User enters data. Data is stored in the DB using some key that is stored in the cookie.
- When user leaves, you send them an email with a https: link
- When user comes back, site discovers the cookie and can present the user with the old data.
Now, the user wants to use a different browser on a different machine. In this case, offer a "transfer" button. When the user clicks on this button, she will get a "token". She can use this token on another computer to reset the cookie. This way, the user decide how secure she wants to transfer the token.
SSL secures the contents of the data in transit, but I'm not sure about the URL.
Regardless, one way to mitigate an attacker reusing that URL token is to make sure each token can only be used once. You could even set a cookie so that the legitimate user can continue to use the link, but after the first access it will only work for someone with the cookie.
If the user's email is compromised and an attacker gets the link first, well, you're hosed. But the user also has bigger problems.
E-mail is inherently insecure. If anyone can click on that link and get to the data, you're not really protecting it.