14 ms·
The purpose of the checksum is to help secret scanners avoid false positives, not to optimize the (extremely rare) case where an API key has a typo
by ramchip 5mo ago
The purpose of the checksum is to help secret scanners avoid false positives, not to optimize the (extremely rare) case where an API key has a typo
- vjay15 5mo agothank you so much ram chip :) I didnt know that!
- matja 5mo agoI suppose there could be two checksums, or two hashes: the public spec that can be used by API key scanners on the client side to detect leaks, and an internal hash with a secret nonce that is used to validate that the API key is potentially valid before needing to look it up in the database. That lets clients detect leaks, but malicious clients cant generate lots of valid-looking keys to spam your API endpoint and generate database load for just looking up API keys.
- ramchip 5mo agoThat second hash is called a Message Authentication Code (MAC), it's what the JWT HS256 algorithm does