We have open endpoints because there is a flow where access token is still not presented. Because of that, I've implemented HMAC + DPAPI (using Azure Blob Storage) to store the keys, without involving config files/database. DPAPI is shared between the applications (using .SetApplicationName())
The flow is basically:
- Create new application Id, random secret and random protector key
- Hash the request and protect the secret and application id with DPAPI.
- Send the request with Authorization header with required hash data and also include the Encrypted payload and protector key.
- Server receives the requests, using the random protector key and the encrypted payload try to unprotect the data, if its fine we get the secret from the unprotected payload to verify hash.
This is working, however how secure is that? The only way I can see a potential access to the endpoints would be if someone gets access to the application config file and gets the connection string for the blob storage. Then simply adds data protection in his own application with the application name and replicates creating of the request. Besides that, what else could go wrong?
Also for DPAPI, I'm using
ITimeLimitedDataProtector, with 3 minutes expiration.