Visual LANSA Forum

Posted: **Fri Sep 13, 2024 7:11 am**

I am working on the creation of Secure APIs, I followed the documentation given by LANSA, but I don't now how to manage the "Secrets" for generating the signature and the validation for the JWT tokens, currently the secret is writen on the program, ¿ Is there any sugestion for saving this secrets and improve the security of the services ?.

Share with you the code for generating the JWT Token

Code: Select all

If (#jwt.Claims<"Username"> *IsNot *Null)

#JsonBody.Username := #jwt.Claims<"Username">.AsString
#JsonBody.AccessToken := #HSnnn.IssueToken( #jwt "SECRET" )

#Operation.Response.SetContentJson( #JsonBody )
Endif

And also the code for validating the JWT Token

Code: Select all

If (#HSnnn.TryVerifyToken( #Security.HttpBearer.Value, #jwt, "SECRET" ))

If (#jwt.Claims<"Username"> *IsNot *Null)

#Verified := true
#FZUsuario := #jwt.Claims<"Username">.AsString
Endif

Endif

I have this routines in the same server module asociated to an API, all was generated automatically for LANSA API template

Posted: **Sat Sep 14, 2024 12:47 am**

You might want to consider soft coding the secret and having it stored in an encrypted table. Then you can retrieve it using a fetch from the table.

Posted: **Sat Sep 14, 2024 11:30 pm**

Soft coding it in encrypted in a table also gives you the opportunity to change it periodically.

You can have one server module dedicated to generate the token and process those request. So the other server modules just verify it.

Posted: **Mon Sep 16, 2024 6:51 pm**

If you are running on a iSeries, you can use a DTAARA on the server to store it.
Just retrieve from there using BIF.

Posted: **Tue Sep 17, 2024 1:10 am**

Dino wrote: Sat Sep 14, 2024 11:30 pm Soft coding it in encrypted in a table also gives you the opportunity to change it periodically.

You can have one server module dedicated to generate the token and process those request. So the other server modules just verify it.

Hi Dino, Do you know If there's a documention reference for following this strategy ? I can't find the documentation for creating the encrypted Table

Visual LANSA Forum

Secret Management for JWT Secure APIs

Secret Management for JWT Secure APIs

Re: Secret Management for JWT Secure APIs

Re: Secret Management for JWT Secure APIs

Re: Secret Management for JWT Secure APIs

Re: Secret Management for JWT Secure APIs