How would you generate a token?

[RitikJaiswal75]

Once the user enters /verify they get a link to my site along with a token as a query param.
I would like to ask what approach would someone use to generate a secure token.

The method I tried:

• Extract the discord id of the user
• create a digest with the sha256 algorithm and hash it to base 16

Improvements that can be made

• mix up the discord id with a random salt and then generate the digest.
• Add an expiry to it

Suggestions received

• Do not use discord id in it. Keep it completely random

Challenges raised by suggestion

• How will we avoid collision (No 2 users get same digest)

[lakshayman]

Hey Ritik
So I understood that you need random unique secret keys for specific users. It's a great question we also faced this issue while creating the identity service verification part.
So what we did is we created a collection in firestore and whenever we want a key for a user, we create a document with the user ID and timestamp and use its document ID as a secret key. Firestore handles its uniqueness and it's also random.

[RitikJaiswal75]

Hi Lakshay
We also discovered a way with Lakshya Rawat.
We landed to the conclusion saying we could also do it via discord OAuth link similar to connecting your social accounts to any application like in twitch you can connect your youtube.

Can you tell me why do we not use this method?

[lakshayman]

Ok so with identity service we don't have any service which provides OAuth token. In this case, Lakshya is right we should use OAuth.

[RitikJaiswal75]

Hi Lakshay,
We can not include OAuth as it will add an additional login step to our flow and we do not need that additional flow.
We are expecting something like this:

• You are logged in to discord over the discord app.
• You are also logged in to our RDS my-site
• So we would just extract the discord id and attach it to the logged-in user of my site.
• To do that we provide the user with a timed token as a auth parameter in query params.
  • Something like: `https://my.realdevsquad.com/link/?auth=<some_token>
• We do not want the token to guessable
  • I tried an approach to take in the discord id and salt it with some secret text and then hash it along with the expiry time.
    • this was rejected as using discord id would make it guessable.
  • If I generate totally random token this may lead to a collision between 2 users.
• I am currently exploring: Generating password reset tokens as suggested by Lakshya Rawat.

[rohan09-raj]

We can use UUID package to generate the random strings.
https://www.npmjs.com/package/uuid