Store encrypted https query strings in lieu of user credentials? -
i'm building app need store users' login credentials 3rd party service. communication 3rd party service done via https requests.
from i've seen, looking @ posts this one, there's no clear answer best practices doing this, , specific methods discussed in post @ least leave desired.
so 1 thought had perhaps it'd possible around problem "pre-encrypting" query string 3rd party request , storing encrypted data in db in lieu of storing users' credentials directly. way can store credentials in encrypted form not worry key being compromised, it's held 3rd party, not me. , if db compromised intruder wouldn't more obtain packet sniffing.
i can't seem find examples of doing this, i'd feedback on whether community thinks it's reasonable approach. beyond that, little on how great. i'm building app in node.js/express, , i'm using https module handle communication 3rd party, i'd have go @ at lower level in order take approach.
the basic process be:
- do same thing https.request in order establish ssl/tls connection 3rd party , encrypt query string containing user's credentials
- stop short of sending encrypted data 3rd party , instead store in db
- at later time, "reconstruct" https connection stored data , send 3rd party, process response, win
that won't work, sorry. https renegotiates new session key each time, data different on wire each new request.
Comments
Post a Comment