The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
0answers
151 views

Securing a REST API based on authentication with external site

I have a website with an already-established authentication system. Once a user logs on to it, one of the features is a statistics application based on AngularJS. The app communicates with an ...
1
vote
0answers
55 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
5
votes
1answer
2k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
-1
votes
1answer
28 views

Requesting Advice Regarding Storing Encryption Keys

I am using HMAC to hash some data before inserting it in a database and currently I have my key as a static field. Just wondering what the best practice regarding storing the key would be. Is having ...
0
votes
0answers
69 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
1
vote
1answer
468 views

Are python's cryptographic modules good enough?

I mean, say you were writing professional grade software that would involve sensitive client information. (Take this in the context of me being an amateur programmer.) Would you use hlib and hmac? ...
1
vote
1answer
459 views

Using a random string to authenticate HMAC?

I am designing a simple webservice and want to use HMAC for authentication to the service. For the purpose of this question we have: a web service at example.com a secret key shared between a user ...