Azure API Management and HMAC

Question

I wanted to use Azure API management for exposing our existing APIs to third-party developers. Azure API management provides a developer portal where third parties can sign-in and obtain subscription keys. The subscription key is then supposed to be passed with every request as query string parameter or along with POST parameters.

This seems to be a concern since there is a possibility of someone easily getting access to this key if they can intercept HTTP traffic. The common mechanism is to generate HMAC of the request using client secret and sending it along with the request to ensure integrity and authenticity of the request and not send the client secret along with the request.

• Is it possible to enable HMAC based integrity checks on Azure API Management?

• Also is it possible to configure Azure API Management to send back the response with HMAC so that client as well can verify that the response is coming from a reliable source?

Answer 1

On the matter of calculating a message authentication code, what would you like to use as input for the hashing function - just the URL, the whole body, something else?

Alternately you can use the client certification authentication policy for added security, but I understand it is not a real replacement for HMAC: https://msdn.microsoft.com/en-us/library/azure/061702a7-3a78-472b-a54a-f3b1e332490d#ClientCertificate