I would just like a sanity check on my plan to implement API authentication/authorization.

  1. Authorized URLs are placed in a secure DB
  2. The client server places a GET request to api-key service with mutual TLS
  3. The URL in the cert is compared to the DB of authorized URLs, and the cert itself checked for validity
  4. A 512bit API key is generated from a CSRNG, SHA hashed, then the hash of the key is stored in a secure location. This key expires after 8 hours
  5. Subsequent requests from the client server place this key in the authorization header and are compared to the stored hash for validity

Are there any problems with this approach that should give me pause?

  • The main question I have is WHY to do it this way. Since the client has obviously the client certificate installed and will continue to send it on future TLS connections if asked so by the server it can be used in the future to authenticate the client. What is the advantage of having a temporary API key here? – Steffen Ullrich May 30 '19 at 3:46
  • @SteffenUllrich This would be a mechanism to provide security for many desperate APIs, managed by different teams. Unfortunately, most of these teams do not have the security knowledge to implement this; when you ask them to roll their own security, they end up hardcoding usernames and passwords. Secondly, there needs to be a centralized place where access is strictly audited. – TheCatWhisperer May 30 '19 at 13:37
  • From my understanding of your idea anybody who wants to connect to a service would need to implement mutual authentication first, i.e. provide the client with a certificate which identifies the specific user. The API key is essentially a time-limited alternative to this certificate but it is necessary to have the certificate based authentication implemented in the client before being able to use the API key based authentication. Which makes me wonder: why additionally implement an API key based authentication if the certificate based authentication is already there? – Steffen Ullrich May 30 '19 at 14:05
  • @SteffenUllrich Someone (me) has to manage the authorization, and auditing of authorizing, of many different services for many different clients – TheCatWhisperer May 30 '19 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.