当 API 调用需要以纯文本形式发送密码时，将密码存储在数据库中的最佳方法是什么? [英] What is the best way to store password in database when API call requires sending of password in plain text?

问题描述

我正在 Django 中编写一个与稍后阅读列表 API (http://readitlaterlist.com/api/docs/).但是，所有 API 调用都需要在每个请求中发送用户名和密码.为了做到这一点，我似乎需要将用户的密码以纯文本形式存储在我的数据库中.我错过了什么，还是在这种情况下这是唯一可能的方法?是否有某种方法可以在我的数据库中存储加密密码，但在进行 API 调用时能够发送它的解密版本?如果没有，那么我应该遵循哪些最佳实践来保护用户的密码?

I'm writing a web app in Django that is interfacing with the Read it Later List API (http://readitlaterlist.com/api/docs/). However, all of the API calls require sending the username and password with each request. In order to do this, it seems that I need to store the user's password in plain text in my database. Am I missing something or is that the only approach possible in this case? Is there some way to store an encrypted password in my database, but yet be able to send a decrypted version of it when making the API call? If not, then are there any best practices that I should be following to safe-guard the user's password?

我很确定这不是唯一需要以纯文本形式发送密码的服务.我有兴趣了解开发人员通常如何处理这类服务.我是 Web 开发的新手，因此感谢任何帮助或指点.

I'm pretty sure that this can't be the only service requiring sending password in plain-text. I'm interested in knowing how developers deal with these sort of services in general. I'm new to web development, so any help or pointers is appreciated.

推荐答案

永远不要以纯文本形式保存密码.您可以对密码进行加密和解密，但问题是您用于加密和解密的密钥通常可供任何有权访问您的服务器的人访问，因此不安全.

Never save password in plain text. You can encrypt and decrypt the password but the problem is that the key you use to do the encryption and decryption will generally be accessible to anyone who has gained access to your server so it's not secure.

另一种方法是要求他们输入密码并将其保存在加密的 cookie、会话变量或其他在他们退出您的应用时会过期的东西中.这样做的缺点是他们每次使用您的应用程序时都必须输入密码.

An alternative is to ask them to enter their password and save it in an encrypted cookie, or session variable or something else that will expire when they have logged out of your app. This has the drawback of them having to enter their password every time they user your app.

这篇关于当 API 调用需要以纯文本形式发送密码时，将密码存储在数据库中的最佳方法是什么?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！