What is the best approach for generating the keys whenever use authenticate request

Question

1.00/5 (1 vote)

See more:

Generally in MVC we are using API key generation in webapi but we have problem with API
key generation that is anyone who makes a request of a service transmits their key, in theory, this key can be picked up just as easy as any network transmission, and if any point in the entire network is insecure, the entire network is exposed. This makes API keys a hard thing to recommend – often misused and fundamentally insecure,

that's why i need best approach for generate the keys whenever use Authinticate request

Please help me,

Thank u.

What I have tried:

anyone who makes a request of a service transmits their key, in theory, this key can be picked up just as easy as any network transmission, and if any point in the entire network is insecure, the entire network is exposed. This makes API keys a hard thing to recommend – often misused and fundamentally insecure,

Posted 5-Nov-18 19:51pm

Member 11816204

Updated 6-Nov-18 2:13am

Add a Solution

Comments

Member 11816204 6-Nov-18 2:05am

Please help me

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard Deeming · Answer 1 · 2018-11-06T02:13:00

Use and enforce HTTPS. This will automatically encrypt the traffic between the client and your server.

The only way anyone would be able to intercept the key would be if they had compromised the client, compromised your server, or tricked a rouge Certificate Authority into issuing a false certificate for your site. In any of those scenarios, you'd have bigger problems to worry about.

Assuming your DNS is set up correctly, you don't even need to pay - Let's Encrypt[^] will give you a certificate for free. On Windows, you can use Windows ACME Simple[^] to obtain and renew the certificate automatically.