How to design secure web API access for your website? When we open web API access to users, we need to make sure each API call is authenticated. This means the user must be who they claim to be. In this post, we explore two common ways: 1. Token based authentication 2. HMAC (Hash-based Message Authentication Code) authentication The diagram below illustrates how they work. Token based Step 1 - the user enters their password into the client, and the client sends the password to the Authentication Server. Step 2 - the Authentication Server authenticates the credentials and generates a token with an expiry time. Steps 3 and 4 - now the client can send requests to access server resources with the token in the HTTP header. This access is valid until the token expires. HMAC based This mechanism generates a Message Authentication Code (signature) by using a hash function (SHA256 or MD5). Steps 1 and 2 - the server generates two keys, one is Public APP ID (public key) and the other one is API Key (private key). Step 3 - we now generate a HMAC signature on the client side (hmac A). This signature is generated with a set of attributes listed in the diagram. Step 4 - the client sends requests to access server resources with hmac A in the HTTP header. Step 5 - the server receives the request which contains the request data and the authentication header. It extracts the necessary attributes from the request and uses the API key that’s stored on the server side to generate a signature (hmac B.) Steps 6 and 7 - the server compares hmac A (generated on the client side) and hmac B (generated on the server side). If they are matched, the requested resource will be returned to the client. – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/3KCnWXq

How does a Password Manager such as 1Password or Lastpass work? How does it keep our passwords safe? The diagram below shows how a typical password manager works. A password manager generates and stores passwords for us. We can use it via application, browser extension, or command line. Not only does a password manager store passwords for individuals but also it supports password management for teams in small businesses and big enterprises. Let’s go through the steps. Step 1: When we sign up for a password manager, we enter our email address and set up an account password. The password manager generates a secret key for us. The 3 fields are used to generate MUK (Master Unlock Key) and SRP-X using the 2SKD algorithm. MUK is used to decrypt vaults that store our passwords. Note that the secret key is stored locally, and will not be sent to the password manager’s server side. Step 2: The MUK generated in Step 1 is used to generate the encrypted MP key of the primary keyset. Steps 3-5: The MP key is then used to generate a private key, which can be used to generate AES keys in other keysets. The private key is also used to generate the vault key. Vault stores a collection of items for us on the server side. The items can be passwords notes etc. Step 6: The vault key is used to encrypt the items in the vault. Because of the complex process, the password manager has no way to know the encrypted passwords. We only need to remember one account password, and the password manager will remember the rest. Over to you: Which password manager have you used? – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/3KCnWXq