okfn/annotator-store — Issue #33: Use proper HMAC signing for authToken generation
Author: nickstenning
Created: 2012-02-14 10:32:57+00:00
State: open

Strictly speaking, the simple concatenate-and-hash algorithm currently used to calculate the authToken isn't a very good idea. For reference, see:

- http://benlog.com/articles/2008/06/19/dont-hash-secrets/
- http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-hashes-use-hmac/

as well as the problems Flickr got into when they did (almost) the same thing as us:

- http://netifera.com/research/flickr_api_signature_forgery.pdf

I'm proposing that we use [itsdangerous](http://packages.python.org/itsdangerous/) here, which could also result in a drastic simplification of the auth protocol -- namely that we might end up requiring only two headers: `X-Annotator-Auth-Token` and `X-Annotator-Consumer-Key`, with everything else (including arbitrary extensions) bundled up in the authToken.