9 ms·
But logging in gets you a new hash with your new org id, right?
by lsaferite 2mo ago
But logging in gets you a new hash with your new org id, right?
- tybit 2mo agoYeah, if user -> org tenancy is stored in the same database without any similar defence in depth then a fresh API key after updating org would work around this. Would be a interesting topic for them to cover. I think the same HMAC(pepper, user, org) as a validation column would work. Better yet, encryption with AAD on any tenancy data if you have a TPM available.