API Security

Cybersecurity 24 Sep 2026 5 min read

HTTP Message Signatures Bind Selected HTTP Components

TLS protects an HTTP exchange while traffic moves across a TLS connection, but some application designs need a cryptographic assertion attached to the HTTP message itself. A gateway may terminate TLS before forwarding a request, a service may need to authenticate selected request metadata, or a message may cross several HTTP hops where transport protection and application trust are separate concerns. HTTP Message Signatures, specified in RFC 9421, address that boundary. A signer chooses HTTP message components, constructs a defined signature base, signs it, and sends metadata that tells a verifier which components and parameters were covered. The mechanism is selective by design: a signature does not automatically cover every field or every property of the message.

Cybersecurity HTTP

Cybersecurity 07 Sep 2026 10 min read

Store API Keys as Verifiers, Not Recoverable Secrets

An API key is often treated like a password: a client presents a secret string, and the server decides whether that string represents an authorized caller. Yet many systems store API keys in plaintext because the application needs to compare them later. That design creates an avoidable consequence. If an attacker obtains the credential database, every stored plaintext key may immediately become a usable credential. The database leak becomes an authentication compromise as well as a data leak.

Cybersecurity API Security