0

I am working on an application which accepts API Token. To be more secure, i want to ask the client (User or Another Application) to encrypt the API Token using their private key so that i can decrypt the same at Apache Reverse Proxy using the client's public key and forward to Tomcat.

I have some questions here:

  1. How can i decrypt a header in Apache through a public key?
  2. How do i enforce that my Apache only accepts Basic Auth or only Bearer Auth?
Phoenix
  • 11
  • 1

1 Answers1

1

Don't.

Use TLS to ensure that the token is secure in transit. Don't bother about securing it further, as it has to be available for the client and the server. Adding client side encryption won't increase security, but is extra code to be maintained for little or no gain.

vidarlo
  • 6,654
  • 2
  • 18
  • 31