Home/ Questions/Q 5849857
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T13:03:34+00:00

I’m designing a web service that clients connect to in order to retrieve some

  • 0

I’m designing a web service that clients connect to in order to retrieve some private data. Each client has a unique ID and a secret key (generated by the server) that are sent as parameters to the web service in order to authenticate itself. In addition, all communications are done over HTTPS.

I’m also planning to use HMAC-SHA256, in order to avoid sending the secret key over the wire.

However, I’m wondering whether this is strictly necessary. Since HTTPS gives me a secure channel between client and server, why would I really mind sending the secret key over that channel?

The only reason I managed to come up with is that an unknowledgeable developer might add a service in the future and not reject non-HTTPS connections, so hashing the secret key is a sort of insurance against the realities of corporate software development, an extra line of defense if you will.

Am I missing something more significant? Is this a real vulnerability that some attack vector could take advantage of?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team
    • An attacker installs a fake trusted certificate into a browser and hijacks the session.
    • A link to your site is sent, but the redirection to SSL is intercepted and a non-SSL session commences.

    There are others, but the story is this: SSL is complicated and often attacked in inventive ways. If your connection is secure, then the hashing has little value compared to the complexity in code for humans and the cost in cpu time. However, if the SSL session is compromised, then you’ve still saved your key. Much as we hash passwords in databases despite the fact that nobody undesirable should have access, hashing your key despite SSL would be wise.

    • 0