search

stevespringett / Alpine

An opinionated scaffolding framework that jumpstarts Java projects with an API-first design, secure defaults, and minimal dependencies
Apache License 2.0
62 stars 40 forks source link

Api Keys hashed in DB #687

Open Gepardgame opened 1 month ago

Gepardgame commented 1 month ago

Description

This PR addresses #532 by changing from API Keys being stored in plain to be stored as a hash.

Will be hashed with SHA3_256. Only at creation time are once returned in plain, so it can be used. Adds a suffix to the API Key, on which the key will be retrieved from the db. Masked Key is now at the ending the suffix. Hashed Key will be also not returned in the API.

Gepardgame commented 3 weeks ago

Also, do you have a migration strategy in mind for this? How do we deal with existing API keys that are not hashed yet?

Simpliest way would be to provide a script, that simply gets every key, hashs it and update it in the DB. Would that suffice, or should it something be, there the user doesn't need to do anything? Then maybe temporarily support both and update it in the code, and after a while only support hashed ones. Or maybe add a function to the code that once gets all keys and updates them. That way you need to once upgrade to this version to get it to work later.

Gepardgame commented 3 weeks ago

2 things remaining:

  1. when response contains an API Key, key value should not be showen, only if you create/regenerate it.
  2. Team Creation should no longer support creating Api key, as the Clear API Key is never returned, and therefore cannot be used.