I have an application server, written in C++ and also uses REST API to serve requests. There is no database, just a simple service which returns if the content of request is valid.


The server is in a local network and only reachable there, has no internet connections, and only meant to serve request from the same local network.

Our solution

Now I want to secure the REST API with Basic Authentication, with one user only, and have no idea if this following method to store password is secure enough :

  1. The password will be passed as parameter on deployment
  2. The deployment will encrypt (with DES) the password with a key, store it in an environment variable, say PASSWORDENV, whereas the key will be hard-coded in the application code.
  3. When request comes, the application should read the HTTP headers for id and password, encrypts the password, and compares with PASSWORDENV


  1. The encryption key is hardcoded, but I dont know any other way else to verify the password
  2. Is there any security problem with our solution ?
  • You've described the situation and you have described your proposed solution. But you have not described the problem your solution is supposed to solve. It's not at all clear why you need to encrypt anything at all. Also, just out of curiosity, why did you choose DES encryption? DES is deprecated for most applications.
    – hft
    Apr 25, 2020 at 1:42
  • @hft I know now that encryption and DES is a bad idea. Basically I want to make sure the service can only be used by some certain people. So we deployed it in a machine which has no internet connection and only accessible internally and also has a password for that. My main question if the proposed solution was good enough, or there are risks I am not aware of. Of course it was not the best idea, but since the connection to the machine is already very limited, i looked for a "good enough" solution. Apr 27, 2020 at 8:30

4 Answers 4


Basic Authentication, will give you marginally more security than you already have:

Consider the vectors you are defending against: bad actor who gains access to the network or disgruntled employee with access to the network.

Bad Actor: If you are not using TLS, anyone on the network will see the entire request/responses (including the password), so TLS is required to prevent the first vector.

Disgruntled Employee: If you are using TLS, anyone on the network with the private keys, will be able to see the entire request/response (including the password), something more may be required to prevent all instances of the second vector.

Now you need to assess the risk associated with these vulnerabilities, which requires you to consider the probability of the vulnerability being exploited and the loss you would take if the vulnerability was exploited (financial, repetitional, etc.)

Side Note:

There are widely accepted forms of token based authentication that may help increase the security of authentication: OAuth or OpenID may work depending on your use case.


First of all, what's the point of encrypting the password? If you are using basic authentication you have the cleartext password, so the most basic precaution would be to hash it (e.g. using argon)

Second, if you want a to move out the authentication from your system, just pass that on to a different system, such as as RADIUS or LDAP server. This lets you expand tat even more than a single user, such as allowing a whole set of users from your central authentication to be able to query your service using their credentials, based on some group membership.

  • I know now that encryption is bad and we should use hash instead. However, using a different system is out of question for us, as its too complicated for our non critical, internal application. Non critical in a sense that the service does not have data, and is ok to be shut down for a while. Apr 27, 2020 at 8:31

Of course there is a security concern, but at least you have identified the risk which is the first step. Now you need to analyze it and then mitigate it. You actually have two problems:

  1. The password saved on disk in the application code
  2. The password communicated in the network.

You do encrypt the password in the communication, so #2 would be fine. You may want to add TLS (HTTPS instead of HTTP).

The remaining problem is #1 (password saved on disk), but in order to avoid this you would have to go with a central "identity management" system (like Active Directory, LDAP, oAuth server etc.). If you don't have this, you have to mitigate the risk by other 'compensating' measures, that is strengthening your environment in general, so that 'bad guys' cannot get to the password.

Such 'compensating' measures can be: stricter access control (who accesses the code and can see the password), regular audits, network access control, limit the number of administrators etc.


and only reachable there


with one user only

And how are you going to ensure the situation stays like that?

The deployment will encrypt (with DES) the password with a key, store it in an environment variable, say PASSWORDENV, whereas the key will be hard-coded in the application code.

No. Its only fractionally better than just storing the password in clear text. Either use one way hashing or key pairs/quorum encryption. There are implenmentations available off the shelf.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .