sparebytes/tokens-exercise

Tokens Service Exercise

Configuration

• We must be very careful about any misconfigurations to prevent downtime and insecure settings

Encryption at rest

• AES 256 GCM
• Changing primary encryption key mid-process
• Encryption Key Rotation

Encryption in Transit

• Ensure the internal network communication is encrypted

Tokens

• UUIDs for Tokens

Persistence

• DB Transaction for Update
• Expiring Updated Tokens

Logging

• Logging
• Internal Server Errors
• Errors

Auth

• Bearer Tokens
  • Provides protection if services which do not need access to this api are compromised.
  • Provides protection if the database is compromised
  • Each service which requires access should use a unique bearer token to for rate tracking and to allow the services to be quickly removed from the allow-list in the case it is compromised

Api Limits

• Max Secret Size
• Max Tokens at Once
• Rate Limiting

Api

• Updating Secrets

Other Notes

• No public access so typical CORS and other brother precautions protections are not required