Say that I have a big application for which I would like to create a secure API. The standard way to go would be to work with a public API key and a secret API key and provide these to the user. Next, in every API request, the messages are signed using a MAC on the secret key and (some part of) the message.
Now, since this application is a big one, I don't want to have to select my message field on a per-API-gateway basis (e.g. if my API request was for answering a question, message=answer
, if my API request was for posting a comment message=comment
etc...).
For convenience I would hence like to add a cryptographically safe random field, which is added upon every request (let's call this field our salt
). This way I can write one request verification that covers all situations.
My questions is now:
Is this a good idea and why (not) so?