Comments (4)
- Test if the API keys change after the rotation
- Ensure that the rotation hasn't started if we have no API keys instances and the user has recently installed the package.
from drf-simple-apikey.
Implement Key Rotation with Caching for Enhanced Performance
Background
Key rotation enhances security by limiting the potential damage caused by a compromised key. In our design discussions, we've identified the need for centralized control of key rotation configurations, potentially using a RotationConfig model. To ensure the system remains performant and doesn't hit the database on every request, it's recommended to use Django's caching mechanism.
Issue
For projects that haven't set up caching, there will be unnecessary overhead as the system will query the database frequently to check for rotation status.
Proposed Solution
- Rotation Configuration Model:
- Create a
RotationConfig
model with fields likeis_rotation_enabled
,last_rotation_date
, andnext_rotation_date
. - This model should typically contain a single record to hold the current rotation status.
- Create a
- Caching Rotation Status:
- Use Django's caching mechanism to cache the rotation status.
- On every request, check the cache first. If the rotation status isn't in the cache, query the
RotationConfig
model and cache the result. - When the rotation status changes (either through a scheduled task or manual initiation), update the
RotationConfig
model and clear the corresponding cache.
- Configuration Warning:
- On application/package initialization, check if caching is properly configured. If not, issue a warning recommending the configuration of caching for the rotation feature.
- Emphasize the importance of caching in the package documentation.
- Documentation:
- Update the documentation to guide developers on setting up caching for the rotation feature. Provide examples and links to Django's caching documentation.
Acceptance Criteria
- A
RotationConfig
model is implemented and effectively tracks key rotation status. - Rotation status is cached using Django's caching mechanism.
- Warnings are issued if caching isn't set up.
- Documentation is updated to guide developers on setting up caching.
- Celery should be optional as a package, as this feature is not required.
from drf-simple-apikey.
In the future, we will implement features such as :
- A system to notify API key users about ongoing key rotations.
- A mechanism to alert developers about unusual API key usage patterns.
- A model or logging system to track completed key rotations.
from drf-simple-apikey.
@asiedu-kev @LewisYann @Ederene20 I need your opinions here if you have some time.🙏
from drf-simple-apikey.
Related Issues (20)
- Add a script to generate a Fernet key
- Add templates for issues and pull requests
- Bug: Default settings are not loaded in the project HOT 2
- Add an exemple project to the repository
- Add drf-spectacular
- Bug when generating a fernet key using django-admin command HOT 1
- Bad design for api key customization
- DoesNotExist error not related to custom model
- Can not generate a new fernet key if one is not already configured in the setting
- Support Django 4.x HOT 1
- Add an exemple project showcasing how to use the package
- Migrate to Django 4.2 LTS
- Add Translations to the Documentation
- Analytics and Monitoring HOT 2
- Rate Limiting HOT 1
- Rename project
- Add Deprecation Warnings for Project Renaming
- Add migrating documentation
- Ensure typing across the projecr
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from drf-simple-apikey.