3 ms·
Nice work! May I inquire as to the design decision behind storing a hash of the long token server-side for verification of the long token, versus digitally sign
by tetch 4y ago
Nice work! May I inquire as to the design decision behind storing a hash of the long token server-side for verification of the long token, versus digitally signing the short token plus a nonce and including this signature in the API key (instead of a long token), as some other API key schemes do?
Both are valid approaches of course, I'm just interested to hear your thoughts on the relative tradeoffs.
- seveibar 4y agoThe signature approach is interesting because it couples the short token the api key, so they're a pair rather than totally independent. Introducing a signature changes the math to create the shortest possible API key with at least 128 bits of entropy (that are not stored server-side). But it's worth looking into!