I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for authenticating and authorizing a particular api request. For example if the following request is performed:

curl -v -X POST https://sample.api.url/transaction \
-H "Private-Key: ThePrivateKeyStringValueGoesHERE" \
-d '{

If ThePrivateKeyStringValueGoesHERE exists within the system then the request will be processed, otherwise the service will issue a 401 response.

Obviously if the Private-Key is ever leaked whomever obtained it would have access to the api, however if this ever happened a new key could be issued and the application could be updated to use the new key (however this process would need to take place by manually changing the key within the application config file since there would not be logic to request a new key).

Are there any concerns I should be aware of before proceeding down this path? Or does this sound like a reasonable approach?

  • can you issue different keys to different groups so that revocation doesn't inconvenience everyone? – dandavis Dec 12 '18 at 22:28
  • @dandavis That is something I did not think of, but can be added relatively simply at this phase of development. – nullReference Dec 13 '18 at 0:28
  • 1
    Don't use a header name that could be added without a CORS request, either by being CORS safelisted or added by the browser (eg. Cookie). The current name looks good. – Ángel Dec 13 '18 at 1:32
  • Consider using mutual SSL (client certification authentication) instead, this would allow the client to prove their identity without the need to actually transmit the secret to the server. The server has the client’s public key/x509 cert and can verify the client posses the corresponding private key via the SSL/TLS handshake mechanism. – Dave M Dec 14 '18 at 2:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.