Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering: it now seems to be more and more common to see people/framework putting cryptographic tokens in the URLs their webapps are generating (to prevent quite effectively against quite some attacks). It is advised by OWASP etc.

However I was wondering: what was the earliest known usage of this technique (specifically inside Web URLs)?

I've found a message on Usenet dating from 2003 (for a Java webapp) describing the technique by someone who, obviously, independently discovered it (he's asking for know "prior art"):

Every single link in any of the jsp page transmitted to the client is 
generated with a checksum that act as a signature for the URL

The description clearly shows it's a cryptographic checksum being used (and the way it works seems very close to the modern "tokens" OWASP advocates etc.).

Interestingly enough the person describing it says that "it cannot hurt" but that it may not be that useful since that Java is relatively immune to buffer overflow. The author couldn't have imagined that this technique would has stopped most XSS and CSRF exploits dead in their track way before these techniques were even invented...

So my question is simple: what are the oldest know usage of this technique you know of?

EDIT Upon re-reading the old description, I think in that message from 2003 the technique is even more advanced than the "per-session tokens" that OWASP advocates in that every single parameters are checked against forgery (but I'm not sure)

share|improve this question
(I hope this very real question for which, indisputably, there exist very valid answers, won't be closed) – Cedric Martin Nov 8 '11 at 17:12
What problem are you trying to solve? What benefit is there in knowing when the earliest usage of this technique was. – ChrisF Nov 8 '11 at 17:15
@ChrisF: If someone were to ask: "When did Huffman discover his minimum-redundancy-code" and you knew the answer, would you give him the answer or tell him: "What benefit is there in knowing when Huffman made his discovery"? How's that not interesting to programmers? – Cedric Martin Nov 8 '11 at 17:21
It may be interesting but it's not what this site is about. Please read the FAQ to see what sort of questions do well here. – ChrisF Nov 8 '11 at 17:22
@tuergeist We've already asked the Cryptography mods and they don't want it. Programming history is ostensibly on-topic here. – user8 Jan 3 '12 at 8:01

PHP (as non JAVA) language that was developed for web applications uses cryptographic hashes in URLs to identify and track a user since 1998. It is known as session ID.

Java Enterprise 1.0 was released in December 1999 and also uses session IDs in URLs.

But I am still unsure what you EXACTLY want to know.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.