Skip to content

Client secret hashed on DataBase #923

@SteDev2

Description

@SteDev2

The client secret is currently stored on database without any encryption, then it should be hashed for security reasons.
This means that the API must ignore any secret received during the creation/update of a client, generate it on POST creation requests and provide it to the user/dashboard one time in the relative response.
If the client's owner loses his client secret, the dashboard will provide him a button to invalidate the current one and generate a new one (returned in the response).
Within the database, the client secret column type won't change but it will be stored as a bcrypt hash instead.
A proper migration that encrypts current client secrets is necessary.

Metadata

Metadata

Assignees

Labels

Type

Projects

Status

In Progress

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions