Timeline for API key generation technique
Current License: CC BY-SA 4.0
2 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 30, 2021 at 15:59 | comment | added | cobru | My use case is an desktop app (installed on premise) calling via https the api. How the app is secured is not my problem. :) I would have just used a random byte sequence as token but I received the extra requirement to not store it in the db as it is, hence the idea to treat the random byte sequence like a password and hash it. I do like that the aes-gcm solution doesn't require me storing anything, however I don't like the extra complexity (plus, if the master key is compromised, all api keys are). | |
| Aug 30, 2021 at 14:40 | history | answered | Maarten Bodewes♦ | CC BY-SA 4.0 |