New answers tagged web-service
2
Clarifying Assumptions
I've asked some clarifying questions in comments. I'll answer assuming the following:
Traffic within your backend is plaintext (ie no TLS).
The API key is sent in plaintext in the basic auth field, and hashing is performed by the server only in order to compare against the stored value.
Hashing and Salt
I fully agree with this ...
2
... our calling out is purely a notification of an event being sent in a fire and forget scenario
In this case there is not much risk if properly implemented. Proper implementation means that any possible problems are known and addressed or that your API access is mostly independent from the rest of the application so that even unforeseen problems will not ...
Top 50 recent answers are included
