1216241 - Show API secret only once.

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: API, defect)

Description

[Mike Nolan [:nolski]]

For security purposes, let's only show the API secret to the user upon generation and store a hash in our database for authentication

Comment 1

[Mark Striemer [:mstriemer]]

I don't think we can store a hash of the secret because we need the original value to verify the signature. I was originally thinking the same thing but I think the best we could do is encrypt it.

Another thought I had was to hash the key instead of the secret which would prevent gaining access to all accounts if the whole table was compromised but that wouldn't help if you knew the key you wanted to attack.

Probably best to get security to weigh in on how to securely store this stuff. Encryption seems like our best bet but it's also the most work.

Comment 2

[Kumar McMillan [:kumar]]

Yes, the secret cannot be hashed because the signature needs access to it. The secret is already encrypted in the database so hiding it from the UI won't require any additional backend work.

Comment 3

[Kumar McMillan [:kumar]]

The UX needs to be very clear on key creation that the secret will never be seen again.

Comment 4

[Kumar McMillan [:kumar]]

This did not get moved to github during the triage