search

opensafely-core / job-server

A server for mediating jobs that can be run in an OpenSAFELY secure environment. q.v. job-runner
https://jobs.opensafely.org
Other
5 stars 10 forks source link

Consider signing PATs #1747

Open ghickman opened 2 years ago

ghickman commented 2 years ago

Would using our PATs for signing $something be of use?

bloodearnest commented 2 years ago

Filling this out at bit, the plan is to currently use our API tokens as passwords, including them in the HTTP Authorization header.

This is ok for now, as were going over HTTPS, but it's not great, as we are still sending the full token in everyrequest.

It might be worth the effort to use the API token to sign each request, and verify it server side as authentication.

But that requires deciding what we should sign to make a request secure.