Oct 30, 2015 API Keys are not security. By design they lack granular control, and there are many vulnerabilities at stake: applications that contain keys can be decompiled to extract keys, or deobfuscated from on-device storage, plaintext files can be stolen for unapproved use, and password managers are susceptible to security risks as with any application. In this piece we outline the disadvantages of. Go to Required Permissions in the application you just registered. Select SharePoint Online under the Select an API in step 1. Then under 2 Select Permissions choose 'Have full control of all site collections'. Now choose KEYS blade and add a key. The key only shows once when you save it. Copy it to notepad. Go to POSTMAN app on your desktop.

Introduction

Hashing is the transformation process of value into a usually shorter fixed-length key/value that represents the original value. A few days ago, we had to use hash comparison to sync data between two systems via API (obviously, it wasn't the most efficient way to use API for data syncing, but we had no option to add any change at source end).

Background

What we were doing:

1. Creating a hash string at our end after object JSON deserialization
2. Comparing that hash string with an existing DB row by a unique identifier (Primary key)
   1. If no row found by the unique identifier (Primary key), adding a new row to the DB
   2. If the hash string wasn't the same, updating the existing row with new values
3. And few other sync log processes

Everything was working as expected until we refactored the existing code (changed name of a few models and properties). The hash string was being generated from the entire object (including all the values) rather than considering specific properties. The way we were creating the hash string was actually wrong. Let's check a few hash string examples.

Hash Helper Class

This is the utility class to manage hash related operations.

Consideration

• Using MD5 hash Hash(byte[] value)
• Any null value is considered as 'null' string Byte(object value)

Object to Hash String Process

1. Create bytes of that object Byte(object value)
2. Create hash bytes from the object bytes Hash(byte[] value)
3. String from hash bytes String(byte[] hash)

A Combined Hash of Multiple Objects

1. Create bytes of each object Byte(object value)
2. Combine or sum the bytes Combine(params byte[][] values)
3. Create hash bytes from the combine or sum the bytes Hash(byte[] value)
4. String from hash bytes String(byte[] hash)

Alternatively:

1. Create combined hash bytes Hash(params object[] values)
2. String from hash bytes String(byte[] hash)

Methods We Are Going to Use More Frequently

• Create a hash string of any string HashString(string value, Encoding encoding = null)
• Create hash/combine hash string of any/group of object HashString(params object[] values)

Hash of Entire Object

The data class or model:

Creating a hash of the model:

Important to Remember

This hash depends on both object structures and assigned values. The generated hash will not be the same even if we assign the same values to the properties, but added some changes like:

• Class/Model name change
• Property name change
• Namespace name change
• Property Number change (add or remove any property)

to the model. And in a development environment, refactoring can take place any time.

Hash of Data Values

Let's make a hash using only values. Creating an interface IHash.

Using IHash to a model and using hash helper inside the method HashString().

This way, the model structure is not taking part in the hash generation process, only specific property values (Name, IsActive, CreatedDateTime) are being considered.

Hash will remain the same until no new value has been set to any of those properties. Any structural change (name change, property add/remove, etc.) to the model will not affect the hash string.

Hash Result

Other Tests

Working fine with null object values:

We will not be able to create the entire People class as it is not using [Serializable]:

BONUS: String Hash

It is quite common to create a password/string hash. So here we have it.

Conclusion

• If we have to compare considering values or specific values only, then using Hash of Data Values is the best option.
• But if we need to compare both object structure and values altogether, go for Hash of Entire Object.

References

My first read many years ago

Bytes

Hash Bytes

Combined Bytes

Bytes to String

Limitations

I haven't considered all possible worst scenarios or code may throw unexpected errors for untested inputs. If any, just let me know.

Find Visual Studio 2017 console application sample code as attachment.

Api Key Google Maps

History

Generating An Api Key Site Stackoverflow.com Download

• 26^th June, 2019: Initial version

Api Key Steam