3 ms·
I know sometimes people just like to try things out, but for the love of god do not implement encryption related functionality yourself. Use JWT tokens and Open
by usernametaken29 6mo ago
I know sometimes people just like to try things out, but for the love of god do not implement encryption related functionality yourself. Use JWT tokens and OpenSSL or another established library to sign them. This problem is solved. Not essentially solved, solved.
Creating your own API key system has a high likelihood of fucking things up for good!
- fabian2k 6mo agoYou don't need any encryption or signing for API keys. Using JWTs is probably more dangerous here, and more annoying for people using the API since you now have to handle refreshing tokens. Plain old API keys are straightforward to implement. Create a long random string and save it in the DB. When someone connects to the API, check if the API key is in your DB and use that to authenticate them. That's it.
- iamflimflam1 6mo agoI would add the capability to be able to seamlessly rotate keys. But otherwise, yes, for love of everything holy - keep it simple.
- swiftcoder 6mo ago> Plain old API keys are straightforward to implement This is pretty much just plain-old-api-keys, at least as far as the auth mechanism is concerned. The prefix slug and the checksum are just there so your vulnerability scanner can find and revoke all the keys folks accidentally commit to github.
- vjay15 6mo agoyes this is the approach!
- sabageti 6mo agoWe don't store it, in plain text right, store them hashed as always.
- notpushkin 6mo agoThe securify here comes from looking the key up in the DB, not from any crypto shenanigans.