Should I harden Commerce Engine ApiSecret?

Question

The default Commerce Engine implementation has a hard-coded Identity Server Api name & secret:

.AddIdentityServerAuthentication(options =>
{
    options.Authority = this.Configuration.GetSection("AppSettings:SitecoreIdentityServerUrl").Value;
    options.RequireHttpsMetadata = false;
    options.EnableCaching = false;
    options.ApiName = "EngineAPI";
    options.ApiSecret = "secret";
});

Should I change the ApiSecret to a more secure string for production usage?

Answer 1

Turns out the ApiSecret is actually unused as the Commerce Engine uses JWT and not Reference tokens. See Identity Server documentation: http://docs.identityserver.io/en/latest/topics/apis.html#supporting-reference-tokens

One could change the code to:

.AddIdentityServerAuthentication(options =>
{
    options.Authority = this.Configuration.GetSection("AppSettings:SitecoreIdentityServerUrl").Value;
    options.ApiName = "EngineAPI";
});

NB. As the Identity Server by default uses RSA encryption it uses the JSON Web Keyset (available at e.g. https://identity/.well-known/openid-configuration/jwks) to verify the JWT.