5 ms·
What's stopping the MITM just copying that header?
by grantism 2y ago
What's stopping the MITM just copying that header?
- gruez 2y agoThere's complicated authentication schemes around hmac that tries to do this, but if you're putting that much effort into it you might as well give up and use https.
- dcow 2y agoSome of these include a nonce and/or are deployed over TLS to prevent replay attacks and avoid sending bearer tokens over the wire. AWS sig v4 and RFC7616 come to mind.
- 4death4 2y agoEven if the copy the header, they can only perform a replay attack, which is an improvement over leaking an API key. Also, you could include a timestamp in the signature to limit the amount of time it could be replayed.
- dcow 2y agoSign a nonce.
- amscanne 2y agoIt’s preventing the theft of the API key. The attack can, at most, replay that specific request (which you could also mitigate with a nonce and expiration).