I have created a login flow that authenticates a front end application (written in Vue.js) to retrieve the user_api_key of a Discourse user, following the guidelines written by @sam here . The authentification works, however the concern I have is with storing the private key safely. At the moment th…

As in an Electron/Tauri app? I have no idea what you would choose, I assume they have some mechanism for secure storage, maybe if you are lucky you can use keychain on mac and something similar on windows.

It’s a web application, hosted on a server. The concern is that somehow the payload could be intercepted if the private key is exposed. I’m aware this is a more general concern with javascript encryption, but asking in case there is a more secure practice for authenticating a web app from Discourse. …

The user api key system is not designed for this use case, if you go through the dance of generating a private key and then go ahead and store it on the server on behalf of the user, why bother with all this dancing, just generate the keys server side. Super hard for me to provide any guidance with…

After talking with my colleague @owengot , here is a more detailed description of the problem. There is a Vue.js based web application that does not have its own active server-side component. It rather is a standalone web application that uses the Discourse API, so in a way Discourse is the server. …

I’m also curious about this, as I’ve started to use the software developed by @owengot . Based on what @tanius , do you think this is a safe way to do it @sam ?

[画像] tanius: Then he discovered the hack that the same private key can be used for multiple users, so he stored it in a file on the web host that also serves the other static files of the web application (JS, CSS etc.). That makes it fast … but now that private key is (1) a shared one and (2) st…

ユーザー認証のためのJavaScriptでのペイロード暗号化の安全な方法

開発

sam (Sam Saffron) 2020 年 9 月 28 日午前 4:02 8

はい、これはやめておきましょう。秘密鍵はクライアントごとに秘密に保つことを意図しています。

鍵生成に 10 秒かかるのは、あなたが支払う必要があるコストです。これを高速化するいくつかの JS 暗号 API も存在します。

トピック		返信	表示
Per User API Keys Not Working Product Support	2	1298	2021 年 9 月 2 日
Encrypted personal messages Marketplace	16	5136	2018 年 11 月 14 日
Can true private messages be implemented? Feature	28	6031	2020 年 3 月 9 日
User API keys should use OAEP padding Feature user-api	8	651	2025 年 12 月 15 日
Encrypted PGP Messaging Feature	54	12958	2021 年 1 月 19 日

ユーザー認証のためのJavaScriptでのペイロード暗号化の安全な方法

関連トピック