Store encrypted https query strings in lieu of user credentials? -


i'm building app need store users' login credentials 3rd party service. communication 3rd party service done via https requests.

from i've seen, looking @ posts this one, there's no clear answer best practices doing this, , specific methods discussed in post @ least leave desired.

so 1 thought had perhaps it'd possible around problem "pre-encrypting" query string 3rd party request , storing encrypted data in db in lieu of storing users' credentials directly. way can store credentials in encrypted form not worry key being compromised, it's held 3rd party, not me. , if db compromised intruder wouldn't more obtain packet sniffing.

i can't seem find examples of doing this, i'd feedback on whether community thinks it's reasonable approach. beyond that, little on how great. i'm building app in node.js/express, , i'm using https module handle communication 3rd party, i'd have go @ at lower level in order take approach.

the basic process be:

  1. do same thing https.request in order establish ssl/tls connection 3rd party , encrypt query string containing user's credentials
  2. stop short of sending encrypted data 3rd party , instead store in db
  3. at later time, "reconstruct" https connection stored data , send 3rd party, process response, win

that won't work, sorry. https renegotiates new session key each time, data different on wire each new request.


Comments

Popular posts from this blog

javascript - DIV "hiding" when changing dropdown value -

Does Firefox offer AppleScript support to get URL of windows? -

android - How to install packaged app on Firefox for mobile? -