API Tokens: A Tedious Survey

Re:API Tokens: A Tedious Survey by scrollaway on Wednesday August 25, 2021 @06:42AM (#28299937)

"Woops. I hit ctrl+enter instead of ctrl+c while copying my secret. Guess production's down for a bit while we roll new ones!"

I mean your core idea is decent but that's just really funny.

There's some amount of practicality being lost if your secrets start growing massively. There's also potentially restrictions to what you can put in them, and a prefix with an underscore or colon might be easier than something that has slashes in it.

Your idea is probably living as a queriable dns record on the domain in question. Or a standard subdomain, or even a .well-known path.

[ Parent | on HN ]

Re:API Tokens: A Tedious Survey by innomatics on Wednesday August 25, 2021 @09:23AM (#28301328)

> Woops

Could require a POST or maybe even HTTP DELETE to guard against woopsies. The latter has semantic niceness about it.

[ Parent | on HN ]

Re:API Tokens: A Tedious Survey by richthegeek on Wednesday August 25, 2021 @07:26AM (#28300202)

The alternative (as in, current reality) is "Whoops. I hit ctrl+entry while copying my secret and no-one noticed for a month. Guess all our data is leaked now!"

It's also up to each provider what actually happens when the "revoke" action is triggered. Maybe they just warn you immediately, which is still better than nothing.

[ Parent | on HN ]

Re:API Tokens: A Tedious Survey by Macha on Wednesday August 25, 2021 @07:45AM (#28300369)

But if it's not a URL, Ctrl-Enter won't do anything.

If it is a URL, it opens in a web browser, and now you have problems.

[ Parent | on HN ]

Re:API Tokens: A Tedious Survey by staticassertion on Wednesday August 25, 2021 @09:01AM (#28301095)

Have shorter lived secrets. Also, not sure we should be solving for the "ctrl c" of secret use case tbh.

[ Parent | on HN ]