In a web app, it's common practice to encrypt sensitive information against a user's password. In this scenario, what's how would you access/encrypt/decrypt that information using token based authentication?

If a user logs into the web app using their username/pw, which gives them access to their sensitive information, how do you create a token (say, for API access), to access/encrypt/decrypt that same information?

migrated from crypto.stackexchange.com Apr 15 at 12:43

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • Encryption is used to ensure the confidentiality of data from someone who could have access to this data without being authorized. In your case, who could have access to user data without authorization ? If it's data in transit between the browser and the server, just use TLS. Otherwise, you will need to explain a bit more your use-case so that we can give you a meaningful answer. – A. Hersean Apr 15 at 14:47
  • Do you need to store the information if it is only accessible to the user? If it's encrypted with the users password, you will not have access to it. – vidarlo Apr 15 at 15:13

I think this question is actually three questions.

Username/password authenticates the user to the application. This establishes a user identity. If you then issue them an API token, this authorizes them to use particular API functionality. Encryption should be completely decoupled from these other actions and handled entirely server-side. An example flow:

User A logs in to example.com. As part of the authentication flow, they are issued a signed bearer token that contains their user identifier and their permission set (standard user). This user wants to view a private document in their account. Their browser makes an API request and passes the bearer token (plus a CSRF token, etc) with the request. The API then validates the permission set on the token and the user identifier's access to the resource. If the authorization check succeeds, the server retrieves the appropriate encryption key (from a secure store) for the resource, decrypts it, and returns it to the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy