当 API 调用需要以纯文本形式发送密码时，在数据库中存储密码的最佳方法是什么? [英] What is the best way to store password in database when API call requires sending of password in plain text?

问题描述

我正在 Django 中编写一个 Web 应用程序，该应用程序与稍后阅读列表 API (http://readitlaterlist.com/api/docs/).但是，所有 API 调用都需要在每个请求中发送用户名和密码.为了做到这一点，我似乎需要将用户的密码以纯文本形式存储在我的数据库中.我是否遗漏了什么，或者这是在这种情况下唯一可能的方法?有什么方法可以将加密的密码存储在我的数据库中，但在进行 API 调用时仍能发送它的解密版本?如果没有，那么我是否应该遵循任何最佳做法来保护用户的密码?

I'm writing a web app in Django that is interfacing with the Read it Later List API (http://readitlaterlist.com/api/docs/). However, all of the API calls require sending the username and password with each request. In order to do this, it seems that I need to store the user's password in plain text in my database. Am I missing something or is that the only approach possible in this case? Is there some way to store an encrypted password in my database, but yet be able to send a decrypted version of it when making the API call? If not, then are there any best practices that I should be following to safe-guard the user's password?

我很确定这不会是唯一需要以纯文本形式发送密码的服务.我有兴趣了解开发人员一般如何处理这些类型的服务.我是 Web 开发的新手，因此非常感谢您的帮助或指点.

I'm pretty sure that this can't be the only service requiring sending password in plain-text. I'm interested in knowing how developers deal with these sort of services in general. I'm new to web development, so any help or pointers is appreciated.

推荐答案

切勿以纯文本格式保存密码.您可以对密码进行加密和解密，但问题是您用来进行加密和解密的密钥通常可供任何有权访问您服务器的人访问，因此它不安全.

Never save password in plain text. You can encrypt and decrypt the password but the problem is that the key you use to do the encryption and decryption will generally be accessible to anyone who has gained access to your server so it's not secure.

另一种方法是要求他们输入密码并将其保存在加密的 cookie、会话变量或其他内容中，这些内容会在他们退出您的应用程序时过期.这样做的缺点是他们每次使用您的应用程序时都必须输入密码.

An alternative is to ask them to enter their password and save it in an encrypted cookie, or session variable or something else that will expire when they have logged out of your app. This has the drawback of them having to enter their password every time they user your app.

这篇关于当 API 调用需要以纯文本形式发送密码时，在数据库中存储密码的最佳方法是什么?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！