Re:OAuth 2.0 Authentication Vulnerabilities
by TriNetra on Sunday March 28, 2021 @02:14AM
(#26608390)
You can use HMAC [0]. Create a UI to collect username/password and make an API call to login endpoint, which should return sessionId/secret. going forward sign API requests using the HMAC protocol without ever revealing the secret on the wire again.
0: https://aspsecuritykit.net/guides/implementing-hmac-scheme-t...