9

I'm writing a web app in Django that is interfacing with the Read it Later List API (http://readitlaterlist.com/api/docs/). However, all of the API calls require sending the username and password with each request. In order to do this, it seems that I need to store the user's password in plain text in my database. Am I missing something or is that the only approach possible in this case? Is there some way to store an encrypted password in my database, but yet be able to send a decrypted version of it when making the API call? If not, then are there any best practices that I should be following to safe-guard the user's password?

I'm pretty sure that this can't be the only service requiring sending password in plain-text. I'm interested in knowing how developers deal with these sort of services in general. I'm new to web development, so any help or pointers is appreciated.

Alinium
  • 1,481
  • 2
  • 17
  • 23
  • I asked a similar question: http://stackoverflow.com/questions/5791083/django-facebook-security-design-for-a-facebook-webapp-that-performs-a-third – Timmy O'Mahony Nov 07 '11 at 12:08

2 Answers2

8

do your users have to log into your website to use it? if you also are making use of a password authentication scheme, you could piggy back on top of that. Use the login password for your site as a cipherkey in a symmetric key cipher to encrypt the api password. then you need only store a hash of the users password (to your own site) and an encrypted password for the remote api.

SingleNegationElimination
  • 151,563
  • 33
  • 264
  • 304
  • That does sound like a really good idea. I'm not using a login password for my site right now, but if I do later, then I will definitely look into this approach. – Alinium Nov 08 '11 at 12:44
4

Never save password in plain text. You can encrypt and decrypt the password but the problem is that the key you use to do the encryption and decryption will generally be accessible to anyone who has gained access to your server so it's not secure.

An alternative is to ask them to enter their password and save it in an encrypted cookie, or session variable or something else that will expire when they have logged out of your app. This has the drawback of them having to enter their password every time they user your app.

Timmy O'Mahony
  • 53,000
  • 18
  • 155
  • 177