0

I have an application server, written in C++ and also uses REST API to serve requests. There is no database, just a simple service which returns if the content of request is valid.

Situation

The server is in a local network and only reachable there, has no internet connections, and only meant to serve request from the same local network.

Our solution

Now I want to secure the REST API with Basic Authentication, with one user only, and have no idea if this following method to store password is secure enough :

  1. The password will be passed as parameter on deployment
  2. The deployment will encrypt (with DES) the password with a key, store it in an environment variable, say PASSWORDENV, whereas the key will be hard-coded in the application code.
  3. When request comes, the application should read the HTTP headers for id and password, encrypts the password, and compares with PASSWORDENV

Concerns

  1. The encryption key is hardcoded, but I dont know any other way else to verify the password
  2. Is there any security problem with our solution ?
  • You've described the situation and you have described your proposed solution. But you have not described the problem your solution is supposed to solve. It's not at all clear why you need to encrypt anything at all. Also, just out of curiosity, why did you choose DES encryption? DES is deprecated for most applications. – hft Apr 25 at 1:42
  • @hft I know now that encryption and DES is a bad idea. Basically I want to make sure the service can only be used by some certain people. So we deployed it in a machine which has no internet connection and only accessible internally and also has a password for that. My main question if the proposed solution was good enough, or there are risks I am not aware of. Of course it was not the best idea, but since the connection to the machine is already very limited, i looked for a "good enough" solution. – Anh Tuấn Phạm Apr 27 at 8:30
0

Basic Authentication, will give you marginally more security than you already have:

Consider the vectors you are defending against: bad actor who gains access to the network or disgruntled employee with access to the network.

Bad Actor: If you are not using TLS, anyone on the network will see the entire request/responses (including the password), so TLS is required to prevent the first vector.

Disgruntled Employee: If you are using TLS, anyone on the network with the private keys, will be able to see the entire request/response (including the password), something more may be required to prevent all instances of the second vector.

Now you need to assess the risk associated with these vulnerabilities, which requires you to consider the probability of the vulnerability being exploited and the loss you would take if the vulnerability was exploited (financial, repetitional, etc.)

Side Note:

There are widely accepted forms of token based authentication that may help increase the security of authentication: OAuth or OpenID may work depending on your use case.

| improve this answer | |
0

First of all, what's the point of encrypting the password? If you are using basic authentication you have the cleartext password, so the most basic precaution would be to hash it (e.g. using argon)

Second, if you want a to move out the authentication from your system, just pass that on to a different system, such as as RADIUS or LDAP server. This lets you expand tat even more than a single user, such as allowing a whole set of users from your central authentication to be able to query your service using their credentials, based on some group membership.

| improve this answer | |
  • I know now that encryption is bad and we should use hash instead. However, using a different system is out of question for us, as its too complicated for our non critical, internal application. Non critical in a sense that the service does not have data, and is ok to be shut down for a while. – Anh Tuấn Phạm Apr 27 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.