I'm a building a RESTful stateless API and I'm using a token for authentication. The problem I'm having is I'm not sure how secure HMAC is.
I'm using a JSON Web Token library that let's me encrypt and decrypt the data I pass in.
Basically, the way it works is this:
If I pass it this JSON:
{
token: "asdasdasdass",
userId: 1234
}
It returns 325345ljljn5llnk4.245j4k5j4525ñ4j55n
, where the first part is the JSON base64 encoded and the second part is the HMAC.
For example if I put:
{
sessionId: 145
}
Is there any way an attacker could generate a valid token with the session ID he wants? Is it doable?
Also, how long should my key length be?
I didn't find answers on this site... and I've been reading a lot.