Security question regarding how an Oauth nonce should be made

Can I really make my requests more secure by using anything else but a rando开发者_StackOverflow社区m 30-character alpha-numeric string for my nonce?

---

Actually, although the RFC says "a random string", the nonce needn't be random. It just has to be unique.

The security benefit of using a nonce is in preventing replay. The server only accepts signed requests, but an attacker could try to capture an already signed request and send it again at a later time. Since the server accepts requests with a particular nonce value only once, this doesn't work.

As a client, your job is to make sure you never send two requests with the same nonce and timestamp. By generating a random string, you ensure this probabilistically. But you could just as well use an global counter that is reset every second.

The server's job is to store all the nonces it receives from a particular client. For practical reasons the server can expire nonces after a certain time, but only if it also rejects all requests with a correspondingly stale timestamp.

So with 20–30 random characters you can be reasonably confident that you'll never generate two identical nonces within a second. But 6–8 characters, like in the RFC examples, are enough if you store and check the nonces you generate or are happy to retry if a server rejects your nonce.

---

The nonce must be random. Its security is determined by how unpredictable it is. Nothing is more unpredictable than randomness. Note that you need to use a secure random number generator. A pseudorandom number generator is not sufficient.

---

Nonce's are used so that the source 1 can validate that the result from source 2 has come from the original source it was talking to.

This is done within a few seconds at the most.

nonce's have no specific criterion on how they should be constructed, but you should always take in account the following:

• Nonce's should be unique, reusing the same nonce increases the chance of a hacker guessing the nonce as such
• nonce's should be constructed using noise, by noise im talking about server information that relate to that exact second.

As long as you believe the nonce cannot be regenerated any time soon then you should be ok.