6

I'm currently designing a API Model to use. A user will have a 'secret_api_key' and a 'public_api_key'. They will send a request to my server with the public key, the form data, and then a hash. The hash is the form data encrypted with the 'secret_api_key'.

This is so that the server will recreate this hash since it knows the 'secret_api_key' and if the hashes are the same then accept the request, else deny it.

My problem is, if someone were to do this using JavaScript then they would have to encrypt this 'on the go' in the browser meaning they will need the 'secret_api_key' to hash it all. But the 'secret_api_key' is meant to be kept away from public eyes, so anyone would be able to look at the script and see the secret key.

Is this a wrong way of doing it? I honestly can't think of a way that you would be able to use my API within a browser using JavaScript (Which would be the main method in which people would use my API)

I know with OAuth you get a 'access_token' which you just send with a request, surely someone could use a traffic sniffer and resend requests with the same access token? Or does OAuth working differently?

Any help or suggestions would be much appreciated.

Thank you.

Improve this question

1 Answer 1

Reset to default
1

You would need a session level key that could be given to the non-trusted javascript. Basically a site running the API would need to have the ability to request an individual session for each of the users from their API key and then the user's session would have to use that key. This allows the trust to be maintained between you and the server hosting content while also allowing the user to perform operations based on the server's key without divulging it.

Improve this answer
6
  • That makes sense, but how could you securely request a key?
    – Tom O
    Nov 27, 2012 at 18:05
  • You would have to have the server do it via a server side script and provide that to the java script.
    – AJ Henderson
    Nov 27, 2012 at 18:29
  • Yeah, but how could the client securely Request it. The server cant just provide it to anyone, surely the client must be identified and authenticated?
    – Tom O
    Nov 27, 2012 at 20:26
  • 1
    That's up to the web server's implementation. The rough handshake would be user authenticates with web service, web service uses it's API key to get a user session key for user from API server. API server generates token and returns to web server and tracks the user it is associated to. Web server gives token to javascript on page instance for user. User can now do stuff with API without server key.
    – AJ Henderson
    Nov 27, 2012 at 20:31
  • Alternate path, if this API is providing the user authentication as well, then it is a little easier, the server that wishes to do stuff for the user would provide it's public key to the user who would then request to the API server that the service with that public key be allowed to access it's info. In this case, authentication is between API server and user, after this is done, the user notifies the web server it should have access and the web service can then use it's private key to access the granted permissions from the API server.
    – AJ Henderson
    Nov 27, 2012 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .