ASP.NET Core MVC How token passing with url is secured

Question

I have looking into code of a web application where token is generated and injected into url instead of auth cookie for each request token is passed with url to accessed secured action. The web application is using token instead of auth cookie. Token life is one day.

This is a sample url
http://localhost:48000/ACX/Default/Login?token=8kzRLdW8lQVIS0MrtlqdZJbmz9p22l33u1wspGOmLgCgEy2MG5XZ0JG1ovVZGiNX7KpAfBVn3

of that web application where token is passing through url.

This code is generating the token which would valid up to 24 hours:

public IActionResult Login([FromBody]LoginModel user)    
{    
    if (user == null)    
    {    
        return BadRequest("Invalid request");    
    }    
        
    if (user.UserName == "johncitizen" && user.Password == "abc@123")    
    {    
        var secretKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("KeyForSignInSecret@1234"));    
        var signinCredentials = new SigningCredentials(secretKey, SecurityAlgorithms.HmacSha256);    
  
        var tokeOptions = new JwtSecurityToken(    
            issuer: "http://localhost:2000",    
            audience: "http://localhost:2000",    
            claims: new List<Claim>(),    
            expires: DateTime.Now.AddMinutes(1440), // valid till 24 hours  
            signingCredentials: signinCredentials    
        );    
  
        var tokenString = new JwtSecurityTokenHandler().WriteToken(tokeOptions);    
        return Ok(new { Token = tokenString });    
    }    
    else    
    {    
        return Unauthorized();    
    }    
}    

My question is: when token is passed through the URL, then any other person can get the URL and impersonate the user. I guess passing token through URL is not secure.

What can we do as a result token would be secure passing through URL? I want to change flow bit in such a way that if another user copy and paste the same URL, then he will not be able to access protected resource. So how to achieve and secure long life token?

Please guide me with approach in details. Thanks

Answer 1

As long as you use SSL, the url is protected from other users, but the user has access and can copy, paste and share. That is also actually true of the cookie, but it’s more work (need to copy the cookie and use postman or curl to do the request)

Answer 2

I re-read your posts. It appears you are trying to make the url secure from copy (share). As suggested this is done with a one use token. That is the token is only valid for one request. the server keeps track of whether the token has been used.

note: this does not prevent sharing, only limits the use of sharing. if you better explained your use case, we could help more.