I have Node.js server which serves an app. In that app you could be asked to login. The login credentials would be authenticated against LDAP.

That server could request/post data from other servers via REST. Those restful endpoints could be secured with basic auth against the same LDAP server.

Is it safe to encrypt <username>:<password> and store this in the session on the Node.js server and, on request, decrypt those credentials and pass them in the Basic Auth header value to the restful endpoint?

The encryption key would be randomly created for that session and then destroyed at the end of the session. The credentials only live for the period of a session as well.

  • 1
    Storing it in a session implies that the client has it stored in a cookie? If so, that's a huge no. – Simon Jan 21 '16 at 15:25
  • 2
    Good luck with decrypting anything that was "encrypted" with SHA-2. – Thomas Pornin Jan 21 '16 at 15:34
  • @Simon it would be saved to session variable. – user3018765 Jan 21 '16 at 15:44
  • 1
    Hashes are one way. You want encryption. Google the difference between hashing and encryption. – Neil Smithline Jan 21 '16 at 15:49
  • 3
    @user3018765 Yet you don't seem to understand the difference between encryption and hashing, since you said that you want to use SHA-2 for encryption, which is a hashing algorithm. Now, about your answer to my question, you did not answer it. Would the session variable be accessible by the client? – Simon Jan 21 '16 at 15:59

From strictly a security standpoint, you can do it this way, but it is not ideal. Even though the credentials are only stored temporarily on the server (and perhaps configured to only be stored in memory too), the fact that they are there longer than they potentially need to be poses a risk, albeit a small one. Note that encrypting the credentials in session probably doesn't help you that much, since your key to decrypt must be accessible by the server. In order for someone to read unencrypted session they would need to gain control of the server, and if they did that they could read an encrypted session too, so encrypting it just makes it slightly more annoying for the attacker to get to it. That being said, I would prefer one of these options:

  1. If both the web application and rest applications are using the same LDAP credentials, then there should be a way to configure the rest apps such that they can share the same token the web app is using to authenticate the user with each request. If you can accomplish that you would not need to store anything in session, since the web app could pass on the token it received with each request.

  2. A simpler approach would be for your web server to have it's own set of (admin-like) credentials to access the rest applications, and it would authenticate on its own independently to gather data it needs for the user, perhaps by querying by a particular user id. Of course this assumes the rest services are able to provide this functionality.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.