Hash an API token that comes in an header

[ZordoC]

Hello everyone! Starting off I love this framework :-)!

I'm currently facing this issue regarding security and my API keys.

My approach to design my API was to have the API access keys stored in a database. (hashed) And then once the key would be sent to the header I would hash it again and see if it's present on the db.

I've managed to do almost everything except the fact that I cannot hash the API key once it' submitted ... perhaps easier with an example ...

def check_all_hashed_keys(db: Session = SessionLocal()):
    quer = db.query(models.ApiKeys).with_entities(models.ApiKeys.value).all()
    clean = [ str(path)[3:-3] for path in quer]
    return clean


API_KEY = check_all_hashed_keys()
API_KEY_NAME = "access_token"
COOKIE_DOMAIN = "localtest.me"


api_key_query = APIKeyQuery(name=API_KEY_NAME, auto_error=False)
api_key_header = APIKeyHeader(name=API_KEY_NAME, auto_error=False)
api_key_cookie = APIKeyCookie(name=API_KEY_NAME, auto_error=False)

print(Security(api_key_query))

async def get_api_key(
    api_key_query: str = Security(api_key_query),
    api_key_header: str = Security(api_key_header),
    api_key_cookie: str = Security(api_key_cookie),
):

    if api_key_query in API_KEY:
        return api_key_query
    elif api_key_header in API_KEY:
        return api_key_header
    elif api_key_cookie in API_KEY:
        return api_key_cookie
    else:
        raise HTTPException(
            status_code=HTTP_403_FORBIDDEN, detail="Could not validate credentials"
        )

So API_KEY is a list containing all the Access tokens ( hashed by bcrypt ), now I want to compare both keys however I have a problem! The key submitted is not hashed and the one in the database is.

After checking this code https://github.com/tiangolo/fastapi/blob/master/fastapi/security/api_key.py

I realize that I cannot extract the token via code in order to hash it, which then makes me unable to verify if the Key matches any of the ones present on the database.

Does anyone know a better way of doing this? I thought about changing the source code to my needs ans basically hash it there

class APIKeyQuery(APIKeyBase):
    def __init__(
        self, *, name: str, scheme_name: Optional[str] = None, auto_error: bool = True
    ):
        self.model: APIKey = APIKey(**{"in": APIKeyIn.query}, name=name)
        self.scheme_name = scheme_name or self.__class__.__name__
        self.auto_error = auto_error

    async def __call__(self, request: Request) -> Optional[str]:
        api_key: str = request.query_params.get(self.model.name) 
        if not api_key:
            if self.auto_error:
                raise HTTPException(
                    status_code=HTTP_403_FORBIDDEN, detail="Not authenticated"
                )
            else:
                return None
        return api_key 

Something like this

api_key: str = request.query_params.get(bcrypt.hashpw(self.model.name.encode('utf-8'), bcrypt.gensalt()))  

This looks like a terrible way and I'd like to avoid it at all possible costs!

Anymore information that you may require I can post it here

Best, Jose

[ZordoC]

Hey I've actually figured it out on my own! I was just very confused about how hashing works :-)
The solution was simple have the hash keys in a database and when user request the API the value we get is the un-hashed key, then we just need to use one of bcrypt functions to check if that unhashed value corresponds to any of the hash values.

def check_all_hashed_keys(db: Session = SessionLocal()):
    quer = db.query(models.ApiKeys).with_entities(models.ApiKeys.value).all()
    clean = [ str(path)[3:-3] for path in quer]
    return clean

prefix = os.getenv("CLUSTER_ROUTE_PREFIX", "").rstrip("/")

API_KEY = check_all_hashed_keys()
API_KEY_NAME = "access_token"
COOKIE_DOMAIN = "localtest.me"


api_key_query = APIKeyQuery(name=API_KEY_NAME, auto_error=False)
api_key_header = APIKeyHeader(name=API_KEY_NAME, auto_error=False)
api_key_cookie = APIKeyCookie(name=API_KEY_NAME, auto_error=False)



def check_key(header_key : str,API_KEY: List):
    for hashes in API_KEY:
        if bcrypt.checkpw(header_key.encode('utf-8'),hashes.encode('utf-8')):
            return True


async def get_api_key(
    api_key_query: str = Security(api_key_query),
    api_key_header: str = Security(api_key_header),
    api_key_cookie: str = Security(api_key_cookie),
):
    if api_key_query in API_KEY:
        return api_key_query
    elif check_key(api_key_header,API_KEY):
        return api_key_header
    elif api_key_cookie in API_KEY:
        return api_key_cookie
    else:
        raise HTTPException(
            status_code=HTTP_403_FORBIDDEN, detail="Could not validate credentials"
        )

@app.post(
    "/redact", tags=["REDACT"] , response_model=Response
)
async def redact(body: Request,api_key: APIKey = Depends(get_api_key)):
    """Redact Named Entities from a batch of text """
       pass  #api logic

This worked for me :-)

[tiangolo]

Thanks for reporting back and closing the issue @ZordoC ! ☕

[github-actions]

Assuming the original need was handled, this will be automatically closed now. But feel free to add more comments or create new issues or PRs.