如果您只有密钥，如何使用 bcrypt 验证 api 密钥？
在我的项目中，用户将提供一个 API 密钥，我想将其与数据库中的密钥进行比较。服务器唯一拥有的是请求标头中提供的纯文本密钥。
在 bcrypt 中，我想在数据库中找到这个密钥来验证它。唯一的问题是数据库中的值经过哈希处理和加盐处理。 bcrypt.compare() 可以工作，但前提是我有类似用户电子邮件之类的东西来专门在数据库中找到一个可以与密钥进行比较的文档。
循环浏览每个文档并比较密钥是我唯一的选择，还是有更有效的方法？
In my project the user will provide an API key and I want to compare it to one's in the database. The only thing the server will have is the plain text key being provided in the request headers.
In bcrypt I want to find this key in the database to validate it. The only issue is that the values in the database are hashed and salted. bcrypt.compare() could work, but only if I had something like the user's email to specifically find one document in the database which I could compare the key to.
Is cycling through each document and comparing the keys my only option, or is there a more efficient method?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通常，您还会出于此目的发送某种请求（不仅仅是API密钥）的客户ID，以了解要检查哪个键。
通过许多键将非常慢，这就是重点。存储更多信息（例如某种查找）会削弱您的实现，您可能不应该这样做。在通常的设计中，您只会拥有一个用户名或客户端ID或任何称呼它。
Typically you would also send a client id of some sort with the request (not just the api key) for this very purpose, to know which key to check.
Going through many keys will be very slow, that's kind of the point. Storing more info (like some kind of a lookup) would weaken your implementation and you should probably not do that. In a usual design you would just have a username or client id or whatever you call it.