2

Iv'e moved this from SO as it's more of a design question than a code one.

In many applications third party websites/programs can access the website via a key.

For example, a web application hosts applications each of which have a unique API key. These keys are issued to the various developers to ensure they don't make too many requests based on their contract.

However, the 3rd party applications often make requests in the form:

http://www.thewebapplication.com/my.api?key=TheKey&parameter=SomeValue

These can be seen by a myriad of technologies (fiddler, traffic snoopers). Even worse these requests may be placed in Javascript and made available to everyone. How can you design an API system which helps to protect your clients' API keys?

Liath
  • 3,426
  • 1
  • 21
  • 33

1 Answers1

9

Instead of requiring the actual key, require something that only the key owner can provide, but which doesn't disclose the actual key value.

The usual solution is to expect not the key, but the value of a one-way hash function on the key+something arbitrary. For instance, the developer could generate a nonce value (something that is never sent more than once), combine it with the key, hash the result, and then send the combined hash + the nonce value, but not the key. Your application would then have to check that the hash is correct and that the nonce value wasn't used before (and that the service limit wasn't reached). This allows the client to make as many requests as they want (within their contract), but interceptors can't steal the credentials to spoon services off the contract.

Kilian Foth
  • 109,273
  • Another really popular method is concatenating all the request parameters together plus the API key and SHAing it. On the other hand, this left Flickr open for a large security hole because they used MD5. – Bryan Boettcher Mar 18 '14 at 20:29
  • in that case they would have to also send some sort of ID for the server so they can look up what the person's hash, should be, correct? – TruthOf42 Mar 19 '14 at 13:40
  • How does the client obtain this nonce? Sent by the server? If you hash the key and then send it, the hash essentially becomes the key. – Hugo Oct 22 '19 at 14:02