The more complex the shared key, the harder it is for a malicious user to break the encryption and decipher the shared key. The shared key is the cryptographic key used to generate this encrypted string. If the requested time-out value exceeds the long-lived token life-span setting, a token is still issued but with an expiration that matches this property.Īn ArcGIS token is a string of encrypted information.

If the requested time-out value is less than the long-lived token life-span, a token with the requested expiration value is issued.

Lifespan of Long-lived Tokens: When a client requests a token with a time-out value, the requested time-out value is compared with the duration defined by this property.When a client requests a token with a time-out value less than the short-lived token life-span setting, a token with the requested expiration value is issued. The issued token is only valid for the duration defined by this property. Lifespan of Short-lived Tokens: When a client requests a token but does not specify a time-out value, a short-lived token is issued.Two parameters define the life-span of issued tokens: However, a short expiration time means that applications need to request new tokens more frequently. Tokens with shorter expiration times are more secure, as a token intercepted by a malicious user can only be used within a smaller time window. The end user may see a time-out or other error message if an expired token is used. To maintain the security of the token, each token is associated with an expiration time. The user presents this token whenever accessing a secured resource. ArcGIS Server verifies the supplied credentials and issues a token. To obtain a token, a user provides a valid user name and password. The token expiration time, and some proprietary information. An ArcGIS token is a string of encrypted information that contains the user's name, ArcGIS Server provides a proprietary token-based authentication mechanism where users can authenticate themselves by providing a token instead of a user name and password.

New tokens