29
How to store user's access tokens/API keys without hashing them?
(lemmy.pe1uca.dev)
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Follow the wormhole through a path of communities !webdev@programming.dev
Yes. Don't put nuclear weapons, health data or huge sums of money behind it, but basic Auth has been doing a fine job for a lot of things for a long time, and HTTPS is a complete solution (until the next time it gets owned).
Yep. The hard part is securely delivering the generated secret to them. And making sure that, the shorter and less random that secret is, the more often it gets replaced. For a lot of not-too-sensitive use cases, a phone call and a long random secret will do the job.
JWT is a fantastic solution, and probably the first thing you want to upgrade to if your use case needs more than Basic Auth.
That makes sense. Note that many popular JWT libraries will do a lot of that for you.