How to Create Secret Tokens in Python

If you working with web applications, it usually necessary to If you working with web applications, it usually necessary to generate tokens, API keys, personal keys etc.

We assign them to clients to use as authentication.

We already saw how to create secrets. However using that method could cause problem sometimes like if we use them in url.

Python’s built-in secrets module provides functions for generating secure tokens, suitable for methods such as password resets, hard-to-guess URLs, and similar.

Generating Tokens

Bytes

Return a random byte string containing nbytes number of bytes

<span># utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- </span><span>import</span> <span>string</span>
<span>import</span> <span>secrets</span>
<span>def</span> <span>generate_token_bytes</span><span>(</span><span>length</span><span>:</span> <span>int</span> <span>=</span> <span>32</span><span>):</span>
    <span>return</span> <span>secrets</span><span>.</span><span>token_bytes</span><span>(</span><span>length</span><span>)</span>
<span># utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- </span><span>import</span> <span>string</span>
<span>import</span> <span>secrets</span>


<span>def</span> <span>generate_token_bytes</span><span>(</span><span>length</span><span>:</span> <span>int</span> <span>=</span> <span>32</span><span>):</span>
    <span>return</span> <span>secrets</span><span>.</span><span>token_bytes</span><span>(</span><span>length</span><span>)</span>
# utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- import string
import secrets


def generate_token_bytes(length: int = 32):
    return secrets.token_bytes(length)

Enter fullscreen mode Exit fullscreen mode

<span>In</span> <span>[</span><span>2</span><span>]:</span> <span>generate_token_bytes</span><span>()</span>
<span>Out</span><span>[</span><span>2</span><span>]:</span> <span>b</span><span>'</span><span>\x8a\xb7\x19\xd8\x8f\x94\x16\x15\xed</span><span>g</span><span>\xc1\x83</span><span>3</span><span>\xd4\xb9\xfe\xd8\xa7\xc5\xa1</span><span>7d</span><span>\xd7</span><span>k</span><span>\xe5\x14\xea\xe4\x7f</span><span>z</span><span>\x0f</span><span>}'</span>
<span>In</span> <span>[</span><span>2</span><span>]:</span> <span>generate_token_bytes</span><span>()</span>
<span>Out</span><span>[</span><span>2</span><span>]:</span> <span>b</span><span>'</span><span>\x8a\xb7\x19\xd8\x8f\x94\x16\x15\xed</span><span>g</span><span>\xc1\x83</span><span>3</span><span>\xd4\xb9\xfe\xd8\xa7\xc5\xa1</span><span>7d</span><span>\xd7</span><span>k</span><span>\xe5\x14\xea\xe4\x7f</span><span>z</span><span>\x0f</span><span>}'</span>
In [2]: generate_token_bytes()
Out[2]: b'\x8a\xb7\x19\xd8\x8f\x94\x16\x15\xedg\xc1\x833\xd4\xb9\xfe\xd8\xa7\xc5\xa17d\xd7k\xe5\x14\xea\xe4\x7fz\x0f}'

Enter fullscreen mode Exit fullscreen mode

Hex

Return a random text string, in hexadecimal.

<span># utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- </span><span>import</span> <span>string</span>
<span>import</span> <span>secrets</span>
<span>def</span> <span>generate_token_bytes</span><span>(</span><span>length</span><span>:</span> <span>int</span> <span>=</span> <span>32</span><span>):</span>
    <span>return</span> <span>secrets</span><span>.</span><span>token_bytes</span><span>(</span><span>length</span><span>)</span>
<span># utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- </span><span>import</span> <span>string</span>
<span>import</span> <span>secrets</span>


<span>def</span> <span>generate_token_bytes</span><span>(</span><span>length</span><span>:</span> <span>int</span> <span>=</span> <span>32</span><span>):</span>
    <span>return</span> <span>secrets</span><span>.</span><span>token_bytes</span><span>(</span><span>length</span><span>)</span>
# utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- import string
import secrets


def generate_token_bytes(length: int = 32):
    return secrets.token_bytes(length)

Enter fullscreen mode Exit fullscreen mode

<span>In</span> <span>[</span><span>3</span><span>]:</span> <span>generate_token_hex</span><span>()</span>
<span>Out</span><span>[</span><span>3</span><span>]:</span> <span>'b9165728eb46a36db8389c902c20bd7bd7a8430be398f47818323b0d15b46600'</span>
<span>In</span> <span>[</span><span>3</span><span>]:</span> <span>generate_token_hex</span><span>()</span>
<span>Out</span><span>[</span><span>3</span><span>]:</span> <span>'b9165728eb46a36db8389c902c20bd7bd7a8430be398f47818323b0d15b46600'</span>
In [3]: generate_token_hex()
Out[3]: 'b9165728eb46a36db8389c902c20bd7bd7a8430be398f47818323b0d15b46600'

Enter fullscreen mode Exit fullscreen mode

URL Safe

Return a random URL-safe text string, containing nbytes random bytes.

<span># utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- </span><span>import</span> <span>string</span>
<span>import</span> <span>secrets</span>
<span>def</span> <span>generate_token_urlsafe</span><span>(</span><span>length</span><span>:</span> <span>int</span> <span>=</span> <span>32</span><span>):</span>
    <span>return</span> <span>secrets</span><span>.</span><span>token_urlsafe</span><span>(</span><span>length</span><span>)</span>
<span># utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- </span><span>import</span> <span>string</span>
<span>import</span> <span>secrets</span>


<span>def</span> <span>generate_token_urlsafe</span><span>(</span><span>length</span><span>:</span> <span>int</span> <span>=</span> <span>32</span><span>):</span>
    <span>return</span> <span>secrets</span><span>.</span><span>token_urlsafe</span><span>(</span><span>length</span><span>)</span>
# utils/secrets.py #!/usr/bin/env python3 # -*- coding: utf-8 -*- import string
import secrets


def generate_token_urlsafe(length: int = 32):
    return secrets.token_urlsafe(length)

Enter fullscreen mode Exit fullscreen mode

<span>In</span> <span>[</span><span>5</span><span>]:</span> <span>generate_token_urlsafe</span><span>()</span>
<span>Out</span><span>[</span><span>5</span><span>]:</span> <span>'uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA'</span>
<span>In</span> <span>[</span><span>5</span><span>]:</span> <span>generate_token_urlsafe</span><span>()</span>
<span>Out</span><span>[</span><span>5</span><span>]:</span> <span>'uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA'</span>
In [5]: generate_token_urlsafe()
Out[5]: 'uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA'

Enter fullscreen mode Exit fullscreen mode

urlsafe is very useful when you want to use password reset:

http://tech.serhatteker.com/accounts/reset/MQ/uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA/
http://tech.serhatteker.com/accounts/reset/MQ/uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA/
http://tech.serhatteker.com/accounts/reset/MQ/uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA/

Enter fullscreen mode Exit fullscreen mode

or using it as a password:

<span># redis://user:pass@instance:port/db</span>
redis://redis-user:uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA@redis_instance_url:6379/0
<span># redis://user:pass@instance:port/db</span>
redis://redis-user:uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA@redis_instance_url:6379/0
# redis://user:pass@instance:port/db
redis://redis-user:uNuz07y8mkmwvHftrszV_SFffh9LT25L98UZO0w_LHA@redis_instance_url:6379/0

Enter fullscreen mode Exit fullscreen mode

All done!

原文链接：How to Create Secret Tokens in Python