技术问询：面向公众网站的Sage Pay Token应明文存储还是加盐哈希？

Great question—let’s break this down clearly, since this is a common point of confusion between handling user passwords vs. payment tokens.

First, you cannot salt-hash the Sage Pay token—here’s why:

• The token is a unique identifier issued by Sage Pay that maps directly to a customer’s saved payment method. To initiate subsequent payments, you need to send this exact token back to Sage Pay’s API. Hashing it (even with a salt) would irreversibly alter the value, making it completely useless for future payment requests.

That said, storing it in plaintext is also a critical security risk. Instead, you should:

• Encrypt the token at rest using a strong symmetric encryption algorithm like AES-256. Store the encryption key separately from your database (e.g., in a dedicated secrets manager, not in your codebase or database configuration files). This way, if your database is compromised, attackers can’t misuse the encrypted tokens without accessing the separate encryption key.
• Align with PCI DSS guidelines for handling payment-related data—Sage Pay’s tokenization is designed to reduce your PCI compliance scope, but you still need to secure the token itself properly.

To wrap it up:

• Don’t hash the token (it breaks core functionality)
• Don’t store plaintext (it exposes you to fraud risks)
• Encrypt the token securely and keep the encryption key isolated

内容的提问来源于stack exchange，提问作者Neil Gilbert