Hash auth tokens like API keys
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.5k
- Forks
- 787
- PR merge metrics
- No merged PRs in 30d
Description
Currently, auth tokens are stored in the database as is and unencrypted. If the st2 database is compromised, all the auth tokens connected to the users can be misused. Instead of storing the actual value of the auth tokens in the database, hash the auth tokens like we do with the API keys. The st2 API can validate the auth token in the request by generate the signature and matching the hash value. If the st2 database is compromised, the hashes cannot be used as auth tokens. If an auth token is compromised, the exposure is limited.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by locating the existing API-key hashing implementation, then trace auth-token storage and request validation in the st2 API. Done means tokens are stored as hashes, requests validate against those hashes, and coverage verifies compromised database values cannot be used directly as tokens.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100