How to properly generate authorization tokens? What should be inside the token to protect against brute force?

Proper generation of authorization tokens should ensure uniqueness, security, and protection against brute force attacks. Cryptographically secure random values or signed JWTs are typically used.

What should be inside a token to protect against brute force:

• Unique identifier (e.g., random UUID or nonce) to prevent token repetition.
• Timestamp or expiration to limit the token's lifetime.
• Digital signature or HMAC to prevent token forgery.
• Minimal necessary information for authentication, without excess data.

Example of token generation using Python and the secrets library:

import secrets
import time

def generate_token():
    token = secrets.token_urlsafe(32)  # cryptographically secure random token
    expiration = int(time.time()) + 3600  # token valid for 1 hour
    return {'token': token, 'expires_at': expiration}

To protect against brute force, it is also important to limit the number of attempts and use lockout or delay mechanisms.