View Issue Detail

ID	Project	Category	Submitted / Last Updated
02062	UserSpice	Triage	2024-10-18 07:24:53
Reported	Tomáš Uchytil	Assigned To	Unassigned
Priority	none	Reported	5.7.8
Status	new	Resolution Version and Commit
Summary	Plugin feature request - add expiration to ApiBuilder API keys
Description	It's not priority at the moment, but I believe that API would be more secure, if you added settings option to limit API keys, either for each user's API key or key pool, to be set for limited time (I'd say mayby a year by default? But can be anything, really), after which the key expires and has to be refreshed using username/password combination. Potentially with option to request new valid API key using old key prior to expiration. Just an idea, haven't thought that throuh very deeply. Currently, if API key is leaked or sniffed, it can be exploited indeffinitely. With proposed change, it would limit exploits to remaining time before expiration. I know there are probably usecases that require API key to be constant, that's why I suggest ability to set expiration, not obligation.