Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd like to avoid maintaining a list of usernames and api keys. I'm contemplating this scheme :

  1. User logs in to the website using Google's OAuth2 and a browser.
  2. The website presents the user with an API key by first making an HMAC-SHA1 of :

    • a secret key on the server
    • the username
    • the current time

    and then concatentating that with the username and time, and base64 encoding it all.

  3. This key must be sent by the client with every request : it will be validated by the server, and can be expired by comparing the time to the current time.
  4. Everything is served over SSL.

Does this sound reasonably secure?

Thanks in advance for any thoughts.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.