A more secure way is to ask the user for the password whenever the API key is needed. But of course that's annoying.
If it's the database you worry about, you could always store the sessions data outside the database (in memory or flat files).
But in the end your application needs the API key in plain text, so if a potential attacker gets a certain access level to your application, he will gain access to the API key too.
| [reply] |
The data is as secure as your choices in terms of programming and access. Obviously you should present as little possible sensitive data to the user, and choose secure database passwords and/or file permissions. Perhaps /tmp is not the best place to store such sessions -- choose a database or file in your home directory. If you end up using a database, ensure that it is not possible to use means of SQL injection or similar.
Of course, I am not a security expert, so to learn more, I suggest reading any book dealing with computer security, as this issue is not specific to Perl.
Good luck! :-)
~Thomas~
I believe that the source code to life is written in Perl :-)
| [reply]
[d/l] |