Improved and more secure API Key handling

[rkg-mm]

Current Behavior

Each team gets an API key automatically. All API keys are visible for admins in the web interface (therefore must be stored somewhere in plaintext or only encrypted to be revertable).

Proposed Behavior

1. By default a Team should not have API keys
2. It shall be able to generate API keys by admins, ideally with an additional comment or name, to document the purpose
3. API keys should not be visible in plain text except once after generation
4. API keys should be stored as a secret with proper one-way hashing (basically it's a secret and must be handled like one!)
5. We should consider improving the API key length or at least characters, not sure about best practices but most other systems I know use larger keys
6. (Ideally) Creation Date and Last usage date should be shown next to the API key for the admin to be able to clear up
7. Also consider Enhanced format of API keys (for easier leak detection) #2543

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[valentijnscholten]

I agree these improvements are welcome/needed, but probably should be moved to https://github.com/stevespringett/Alpine ?

[rkg-mm]

If this is part of the alpine framework, then yes :D

[mprencipe]

Alpine doesn't automatically create API keys for teams, it's parametrized:
https://github.com/stevespringett/Alpine/blob/master/alpine-infra/src/main/java/alpine/persistence/AlpineQueryManager.java#L559

Dependency-Track invokes the inherited AlpineQueryManager#createTeam method with the "true" parameter which generates the API key: https://github.com/DependencyTrack/dependency-track/blob/master/src/main/java/org/dependencytrack/resources/v1/TeamResource.java#L135

The simplest fix would be changing true to false.

[nscuro]

@mprencipe That sounds like a sensible thing to do. Do you fancy raising a PR for this?

@rkg-mm:

2. It shall be able to generate API keys by admins, ideally with an additional comment or name, to document the purpose

Comments to document the purpose is coming in v4.11, as per DependencyTrack/frontend#768.

6. (Ideally) Creation Date and Last usage date should be shown next to the API key for the admin to be able to clear up

Timestamps to track creation and "last used" timestamps are coming in v4.11, as per DependencyTrack/frontend#768.

7. Also consider Enhanced format of API keys (for easier leak detection) #2543

This was shipped in v4.9.

[mprencipe]

Sure, I can raise a PR.