TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

How we overcame the security flaws of performing REST API calls in JavaScript

80 pointsby redox_about 11 years ago

10 comments

tptacekabout 11 years ago
Um, eek?<p>You can&#x27;t safely use SHA256 in that construction. The hash is simply the value of the SHA256 internal state after the last block. An attacker can take that hash and resume &quot;hashing&quot; from that point, adding additional data to the original data.<p>That attack is called &quot;length extension&quot;, and it&#x27;s the reason we have the HMAC construction. Here, I think you want the HMAC-SHA256 of the filter and user ID, with the API key as the HMAC key.
评论 #7419467 未加载
评论 #7420769 未加载
tantalorabout 11 years ago
I suggest you investigate oAuth instead of rolling something yourself. That&#x27;s how Google, Facebook, and Twitter solve this problem. Pick whichever version suits your needs,<p><a href="http://oauth.net/core/1.0a/" rel="nofollow">http:&#x2F;&#x2F;oauth.net&#x2F;core&#x2F;1.0a&#x2F;</a> (2009)<p><a href="http://oauth.net/2/" rel="nofollow">http:&#x2F;&#x2F;oauth.net&#x2F;2&#x2F;</a> (2012)
评论 #7420214 未加载
评论 #7420219 未加载
woahabout 11 years ago
I just use the normal cookie sessions over HTTPS. Rolling your own encryption just seems like a bad idea, and I don&#x27;t understand why people do it.
geoka9about 11 years ago
I&#x27;d say that&#x27;s what OAuth2, with its scoped access tokens, was made for.
lsh123about 11 years ago
Sounds like this is not an <i>authentication</i> but an <i>identification</i> protocol applied for a very limited API calls rate-limiting use case. While there are some question about this use case as well (e.g. it there is a DOS attack possible against legitimate clients if the secured_api_key is leaked), it might be practical and acceptable in some limited set of cases.<p>The danger here is that the same protocol will be used for access control use cases for which it is not suitable (for a variety of reasons). A very good documentation (including thread modeling with attack vectors analysis) should be added to make sure this kind of mis-use does not occur. I would also change the title since it is too ambitious and misleading.
flakmonkeyabout 11 years ago
Sounds like you&#x27;ve implemented a type of JWT: <a href="http://openid.net/specs/draft-jones-json-web-token-07.html" rel="nofollow">http:&#x2F;&#x2F;openid.net&#x2F;specs&#x2F;draft-jones-json-web-token-07.html</a>
评论 #7420961 未加载
dmakabout 11 years ago
This is what the implicit grant is for in OAuth: <a href="http://tools.ietf.org/html/rfc6749#section-1.3.2" rel="nofollow">http:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc6749#section-1.3.2</a>
joncalhounabout 11 years ago
I believe Keen.io does something very similar to this as well. iirc they use hashed API keys with some user ID in order to show user specific metrics.<p>I always thought there approach was interesting. Kudos for coming up with something very similar.
hernan604about 11 years ago
read about: SHA1 HMAC
kcbannerabout 11 years ago
Uh oh