At work I have to develop an API that queries data from a Hbase Cluster. They asked me to implement basic authentication in order to secure this API.
The use case is very simple. For the moment we have only one consummer (a client application) and one endpoint. We do not need to create a "registering" endpoint. We do not need to manage access control. The client can access all the data of the endpoint if it has the password.
Moreover, both the API and the Client is "internal" to the company, so I believe we can consider that they will live in a "secure" environment.
Since I do not have a lot of experience in security, I read some documentation on the internet, and I came up with the following solution. I would like to know if you think this is good practice and secure :
1- During development, I generate a user + password with spring cli (spring encodepassword "mystrongpassword"). I then store the hash in the code for authentication :
auth.inMemoryAuthentication() .withUser("user1").password(< GENERATED HASH GOES HERE>)
2- I use Spring Security to implement HTTPS with TLS, in order to secure the transit of the password.
3- The client makes a HTTPS call with his USER + PASSWORD in the authent header (I previously sent the password via a secure process).
4- The server hashes the PASSWORD and compares it with the hash that was previously generated. If it is good, we can send back the queried data.
Is this a secure process ? Do you think this is suitable for a production environment ?