Rotate API Keys

[gmourier]

The purpose of this discussion is to talk about key rotation.

The initial proposal of @juchom here is to have a system with two access keys.

You should consider having per Key two AccessKey, this will help your customers rotate their AccessKey without service discontinuation. If they want to update AccessKey1, they update their application to use AccessKey2, then they can update AccessKey1.

@juchom, could you tell us more about how it might work? Also, I would like to know what is the workaround today according to you if there is one?

A few days ago, we discussed with @MarinPostma, adding an alias. It will add an indirection that would allow switching keys without having to modify the clients if they rely on this alias to retrieve the key.

Another solution could be to do something like GCP and leave an old key available 24 hours before deleting it permanently, thus leaving time to update the clients.

This discussion is created to have a thread dedicated to this topic.

[juchom]

Right now your access keys have only one key which means if you have to update it the workflow would be as follow :

Stop ClientApp
Update Meilisearch Key
Set new Key in ClientApp
Start ClientApp

My purpose is to modify a little bit your key to have two keys Key1 and Key2 so the workflow to rotate keys will be :

ClientApp use Key2 instead of Key1
Rotate Key1 on Meilisearch
ClientApp use Key1 instead of Key2
Rotate Key2 on Meilisearch

There won't be any service discontinuation for customers of ClientApp and the owners of ClientApp can safely rotate keys.

What can be done today is to have two access keys with the same definitions and update them one by one. The main issue with this is if you want to update permissions, you have to update both access keys to avoid discrepancies.

In Azure, if you want to access a blob storage they give you two keys per access key :

[gmourier]

Hi @juchom 👋

Instead of having two rotation keys, what do you think about a key aliasing solution?

An alias could be only assigned to a single key, permitting the client-side to fetch the associated key. Changing the target of the alias would allow having a transparent change in the client code.

WDYT?

[juchom]

Hello,

I'm not sure to understand how an alias will work for a client ? Do you have any product in mind working with this ?

[gmourier]

Here is how it might work:

Suppose you have this API key to authorize requests to Meilisearch, and you want to rotate key used in the client code.

{
     "alias": "mykey",
     "description": "Initial key",
     "key": 12345,
     "actions": ["*"],
     "indexes": ["products"],
     "expiresAt": null
}

Your client code could have fetched that particular API key from an SDK method keys.getByAlias("mykey") The alias is unique and can only be pointed by one API key at a time

You could create another key and point the mykey alias to the newly created key; this way, your client will transparently use the rotated key since it uses the keys.getByAlias("mykey") method.

{
     "alias": "mykey",
     "description": "A rotating key"
     "key": 24567,
     "actions": ["*"],
     "indexes": ["products"],
     "expiresAt": null
}

The disadvantage of this solution is that you have to create another API key every time you want to rotate a key. Also, I don't think the keys.getByAlias method can be used publicly on the front-end since the endpoints key needs the master key.

[juchom]

I'm not sure how it could work if an alias is pointing to only one key at a time ?

You will have to stop the client at some point :
T+0 : alias is pointing to oldKey - client is using oldKey <- WORKING
T+1 : you duplicate oldKey to newKey, alias is pointing to oldKey - client is using oldKey <- WORKING
T+2 : alias is pointing to newKey - client is using oldKey <- NOT WORKING you cannot synchronize server and client at the same time. To avoid service discontinuation for your customers, there is a short period where both keys will be available in order to updates all the applications.

Am I missing something ?

[gmourier]

Hey @juchom 👋

Even though we had a nice discussion about key rotation. I'll answer you now about the alias, sorry for the delay.

What you are missing in your explanation is that the client points to alias and not the value of the key. The client key is automatically updated if the alias targets another API key.

T+0 : alias is pointing to oldKey - client is using alias
T+1 : you duplicate oldKey to newKey, alias is now pointing to newKey - client is using alias <- No need for T+2

The real problem with this method is that a call is made to retrieve the key with the alias to auth further requests from a client. It is difficult to do this purely in the frontend for security reasons so I imagine it being quite limited.