Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing the signed and encrypted string of data. The string is encrypted by the key (known only to me) corresponding to the api_key. I sign the encrypted message with client (not dev) unique key, so two devs sending requests simultaneously will get the same signatures. Dev uses the signed-encrypted string (ses) he got and his api_key to connect (from backend OR frontend) to my websocket. On my backend, I verify integrity of the message, decrypt it with my key and extract the user data, which I then use to serve future requests.

Now the problems start when dev wants to connect to my websocket with JS on his client's machine. This will mean that the dev will have to use his ses and his api_key in plain text on the client. I do check the origin of the request (whenever domain matches specified in API's settings), however the domain can indeed be faked. So here is my question: what can I do to protect ses-api_key pair from somebody else using it to connect to websocket? There might be 5 API users or 5000, so I can't brute-force ses encryption keys from the list. I thought of allowing client to load cross-domain JS file (like FB does to fetch user_id from cookies set for facebook.com with JS and then make server requests), but how would I do that in my case? What should JS do? (my service does set some cookies, such as user_id, part of password's hash, access token and session token)

P.S. Here is the login flow:

  1. Dev create account in my API for his domain example.com. He gets API key: 123
  2. Dev redirect user to auth (domain.com/auth?api_key=123&callback_uri=example.com)
  3. User confirms the action and get's redirected to example.com/?ses=basbdSdhasd.jausdhSDuh1298d9SDohwdjaHDASl9ASD9h8HASdjh9ASd
  4. Dev has JS script that uses ses to connect to socket.domain.com:1234
  5. Dev passes ses value and his api_key on authorization
  6. WebSocket uses secret key to get HMAC-256 of jausdhSDuh1298d9SDohwdjaHDASl9ASD9h8HASdjh9ASd, which will be basbdSdhasd
  7. WebSocket fetches api_secret (known to server and dev) and decrypts the jausdhSDuh1298d9SDohwdjaHDASl9ASD9h8HASdjh9ASd into {userid: john, token: abcdefg, expires: 123456789}
  8. WebSocket processes the data and sends back success if everything is correct
  9. Dev's JS can now communicate with my backend on behalf of my user.
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.