Skip to content

Commit 0559e2a

Browse files
itsobiwongitsobiwong
authored
Merge pull request #22 from SoapBox/change/key-prefix
[Change] Key prefix
2 parents 5466b4b + 620733f commit 0559e2a

File tree

7 files changed

+310
-89
lines changed

7 files changed

+310
-89
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ composer.lock
33
.php_cs.cache
44
coverage
55
.DS_Store
6+
.idea

‎readme.md‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,51 @@ Route::get('/fire', function () {
7272
})->middleware('verify-signature');
7373
```
7474

75+
### Setting Up Additional Keys
76+
77+
You can also set up additional keys to use if you want different keys for different endpoints.
78+
79+
Add them to your environment:
80+
81+
```sh
82+
CUSTOM_SIGNED_REQUEST_ALGORITHM=
83+
CUSTOM_SIGNED_REQUEST_CACHE_PREFIX=
84+
CUSTOM_SIGNED_REQUEST_SIGNATURE_HEADER=
85+
CUSTOM_SIGNED_REQUEST_ALGORITHM_HEADER=
86+
CUSTOM_SIGNED_REQUEST_KEY=
87+
CUSTOM_SIGNED_REQUEST_ALLOW_REPLAYS=
88+
CUSTOM_SIGNED_REQUEST_TOLERANCE_SECONDS=
89+
```
90+
91+
Update the configuration in `signed-requests.php`
92+
93+
```php
94+
'default' => [
95+
...
96+
],
97+
'custom' => [
98+
'algorithm' => env('CUSTOM_SIGNED_REQUEST_ALGORITHM', 'sha256'),
99+
'cache-prefix' => env('CUSTOM_SIGNED_REQUEST_CACHE_PREFIX', 'signed-requests'),
100+
'headers' => [
101+
'signature' => env('CUSTOM_SIGNED_REQUEST_SIGNATURE_HEADER', 'X-Signature'),
102+
'algorithm' => env('CUSTOM_SIGNED_REQUEST_ALGORITHM_HEADER', 'X-Signature-Algorithm')
103+
],
104+
'key' => env('CUSTOM_SIGNED_REQUEST_KEY', 'key'),
105+
'request-replay' => [
106+
'allow' => env('CUSTOM_SIGNED_REQUEST_ALLOW_REPLAYS', false),
107+
'tolerance' => env('CUSTOM_SIGNED_REQUEST_TOLERANCE_SECONDS', 30)
108+
]
109+
]
110+
```
111+
112+
Set up your route to use the custom key. The param you pass must be the same name as the key you set in the configuration in `signed-requests.php`
113+
114+
```php
115+
Route::get('/fire', function () {
116+
return "You'll only see this if the signature of the request is valid!";
117+
})->middleware('verify-signature:custom');
118+
```
119+
75120
### Signing Postman Requests
76121

77122
If you, like us, like to use [postman](https://www.getpostman.com/) to share your api internally you can use the following pre-request script to automatically sign your postman requests:
@@ -87,22 +132,30 @@ function guid() {
87132
s4() + '-' + s4() + s4() + s4();
88133
}
89134

135+
function getTimestamp() {
136+
var date = (new Date()).toISOString();
137+
date = date.split("T");
138+
date[1] = date[1].split(".")[0];
139+
return date.join(' ');
140+
}
141+
90142
postman.setEnvironmentVariable("x-signed-id", guid());
91-
postman.setEnvironmentVariable("x-signed-timestamp", (new Date()).toUTCString());
143+
postman.setEnvironmentVariable("x-signed-timestamp", getTimestamp());
92144
postman.setEnvironmentVariable("x-algorithm", "sha256");
93145

94146
var payload = {
95147
"id": postman.getEnvironmentVariable("x-signed-id"),
96148
"method": request.method,
97149
"timestamp": postman.getEnvironmentVariable("x-signed-timestamp"),
98150
"uri": request.url.replace("{{url}}", postman.getEnvironmentVariable("url")),
99-
"content": (Object.keys(request.data).length === 0) ? "" : request.data
151+
"content": (Object.keys(request.data).length === 0) ? "" : JSON.stringify(JSON.parse(request.data))
100152
};
101153

102154
var hash = CryptoJS.HmacSHA256(JSON.stringify(payload), postman.getEnvironmentVariable("key"));
103155
var signature = hash.toString();
104156

105157
postman.setEnvironmentVariable("x-signature", signature);
158+
106159
```
107160

108161
Note for this to work you'll have to setup your environment to have the following variables:

‎resources/config/signed-requests.php‎

Lines changed: 65 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,74 @@
11
<?php
22

33
return [
4-
/*
5-
|--------------------------------------------------------------------------
6-
| The algorithm to sign the request with
7-
|--------------------------------------------------------------------------
8-
|
9-
| This is the algorithm we'll use to sign the request.
10-
*/
11-
'algorithm' => env('SIGNED_REQUEST_ALGORITHM', 'sha256'),
4+
'default' => [
5+
/*
6+
|--------------------------------------------------------------------------
7+
| The algorithm to sign the request with
8+
|--------------------------------------------------------------------------
9+
|
10+
| This is the algorithm we'll use to sign the request.
11+
*/
12+
'algorithm' => env('SIGNED_REQUEST_ALGORITHM', 'sha256'),
1213

13-
/*
14-
|--------------------------------------------------------------------------
15-
| The prefix to use for all of our cache values
16-
|--------------------------------------------------------------------------
17-
|
18-
| This is the prefix we'll use for all of our keys.
19-
*/
20-
'cache-prefix' => env('SIGNED_REQUEST_CACHE_PREFIX', 'signed-requests'),
14+
/*
15+
|--------------------------------------------------------------------------
16+
| The prefix to use for all of our cache values
17+
|--------------------------------------------------------------------------
18+
|
19+
| This is the prefix we'll use for all of our keys.
20+
*/
21+
'cache-prefix' => env('SIGNED_REQUEST_CACHE_PREFIX', 'signed-requests'),
2122

22-
/*
23-
|--------------------------------------------------------------------------
24-
| Available header overrides
25-
|--------------------------------------------------------------------------
26-
|
27-
| This allows you to customize the http headers that will be inspected to
28-
| look for the signature and algorithm respectively.
29-
*/
30-
'headers' => [
31-
'signature' => env('SIGNED_REQUEST_SIGNATURE_HEADER', 'X-Signature'),
32-
'algorithm' => env('SIGNED_REQUEST_ALGORITHM_HEADER', 'X-Algorithm')
33-
],
23+
/*
24+
|--------------------------------------------------------------------------
25+
| Available header overrides
26+
|--------------------------------------------------------------------------
27+
|
28+
| This allows you to customize the http headers that will be inspected to
29+
| look for the signature and algorithm respectively.
30+
*/
31+
'headers' => [
32+
'signature' => env('SIGNED_REQUEST_SIGNATURE_HEADER', 'X-Signature'),
33+
'algorithm' => env('SIGNED_REQUEST_ALGORITHM_HEADER', 'X-Signature-Algorithm')
34+
],
3435

35-
/*
36-
|--------------------------------------------------------------------------
37-
| The key for signing requests for verification.
38-
|--------------------------------------------------------------------------
39-
|
40-
| This value is the key we'll use to verify signatures with. By default this
41-
| key is expected from the environment. You can change this behaviour,
42-
| however it is not recommended.
43-
*/
44-
'key' => env('SIGNED_REQUEST_KEY', 'key'),
36+
/*
37+
|--------------------------------------------------------------------------
38+
| The key for signing requests for verification.
39+
|--------------------------------------------------------------------------
40+
|
41+
| This value is the key we'll use to verify signatures with. By default this
42+
| key is expected from the environment. You can change this behaviour,
43+
| however it is not recommended.
44+
*/
45+
'key' => env('SIGNED_REQUEST_KEY', 'key'),
4546

46-
/*
47-
|--------------------------------------------------------------------------
48-
| Allows the management and tolerance of request replay's
49-
|--------------------------------------------------------------------------
50-
|
51-
| This allows you to configure if the middleware should prevent the same
52-
| request being replayed to your application, and adjust the tolerance
53-
| for request expiry.
54-
*/
55-
'request-replay' => [
56-
'allow' => env('SIGNED_REQUEST_ALLOW_REPLAYS', false),
57-
'tolerance' => env('SIGNED_REQUEST_TOLERANCE_SECONDS', 30)
47+
/*
48+
|--------------------------------------------------------------------------
49+
| Allows the management and tolerance of request replay's
50+
|--------------------------------------------------------------------------
51+
|
52+
| This allows you to configure if the middleware should prevent the same
53+
| request being replayed to your application, and adjust the tolerance
54+
| for request expiry.
55+
*/
56+
'request-replay' => [
57+
'allow' => env('SIGNED_REQUEST_ALLOW_REPLAYS', false),
58+
'tolerance' => env('SIGNED_REQUEST_TOLERANCE_SECONDS', 30)
59+
]
5860
],
61+
'custom' => [
62+
'algorithm' => env('CUSTOM_SIGNED_REQUEST_ALGORITHM', 'sha256'),
63+
'cache-prefix' => env('CUSTOM_SIGNED_REQUEST_CACHE_PREFIX', 'signed-requests'),
64+
'headers' => [
65+
'signature' => env('CUSTOM_SIGNED_REQUEST_SIGNATURE_HEADER', 'X-Signature'),
66+
'algorithm' => env('CUSTOM_SIGNED_REQUEST_ALGORITHM_HEADER', 'X-Signature-Algorithm')
67+
],
68+
'key' => env('CUSTOM_SIGNED_REQUEST_KEY', 'key'),
69+
'request-replay' => [
70+
'allow' => env('CUSTOM_SIGNED_REQUEST_ALLOW_REPLAYS', false),
71+
'tolerance' => env('CUSTOM_SIGNED_REQUEST_TOLERANCE_SECONDS', 30)
72+
]
73+
]
5974
];

‎run_tests‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
3+
# Any subsequent(*) commands which fail will cause the shell script to exit immediately
4+
set -e
5+
6+
echo "################################################################################";
7+
echo "# Running Integration Tests:"
8+
echo "################################################################################";
9+
./vendor/bin/phpunit --configuration phpunit.xml --testsuite All
10+
echo "################################################################################";
11+
echo "";

‎src/Exceptions/InvalidConfigurationException.php‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?php
2+
3+
namespace SoapBox\SignedRequests\Exceptions;
4+
5+
use Exception;
6+
use Symfony\Component\HttpFoundation\Response;
7+
use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
8+
9+
class InvalidConfigurationException extends Exception implements HttpExceptionInterface
10+
{
11+
/**
12+
* The default exception message.
13+
*
14+
* @var string
15+
*/
16+
const MESSAGE = 'Failed to find Signed Requests configuration key';
17+
18+
/**
19+
* Provides a default error message for an invalid configuration.
20+
*
21+
* @param string $message
22+
* A customizable error message.
23+
*/
24+
public function __construct(string $message = self::MESSAGE)
25+
{
26+
parent::__construct($message);
27+
}
28+
29+
/**
30+
* Returns an HTTP UNPROCESSABLE ENTITY status code.
31+
*
32+
* @return int
33+
* An HTTP UNPROCESSABLE ENTITY response status code
34+
*/
35+
public function getStatusCode()
36+
{
37+
return Response::HTTP_UNPROCESSABLE_ENTITY;
38+
}
39+
40+
/**
41+
* Returns response headers.
42+
*
43+
* @return array
44+
* Response headers
45+
*/
46+
public function getHeaders()
47+
{
48+
return [];
49+
}
50+
}

‎src/Middlewares/Laravel/VerifySignature.php‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use Illuminate\Contracts\Config\Repository as Configurations;
1010
use SoapBox\SignedRequests\Exceptions\ExpiredRequestException;
1111
use SoapBox\SignedRequests\Exceptions\InvalidSignatureException;
12+
use SoapBox\SignedRequests\Exceptions\InvalidConfigurationException;
1213

1314
class VerifySignature
1415
{
@@ -53,27 +54,34 @@ public function __construct(Configurations $configurations, Cache $cache)
5354
* Thrown if request replays are disabled and either the request
5455
* timestamp is outside the window of tolerance, or the request has
5556
* previously been served.
57+
* @throws \SoapBox\SignedRequests\Exceptions\InvalidConfigurationException
58+
* Thrown if the request key is not defined in the config
5659
*
5760
* @param \Illuminate\Http\Request $request
5861
* An instance of the request.
5962
* @param \Closure $next
6063
* A callback function of where to go next.
64+
* @param mixed $requestKey
6165
*
6266
* @return mixed
6367
*/
64-
public function handle(Request $request, Closure $next)
68+
public function handle(Request $request, Closure $next, $requestKey = 'default')
6569
{
70+
if (!array_key_exists($requestKey, $this->configurations->get('signed-requests'))) {
71+
throw new InvalidConfigurationException();
72+
}
73+
6674
$signed = new Verifier($request);
6775

6876
$key = sprintf(
6977
'%s.%s',
70-
$this->configurations->get('signed-requests.cache-prefix'),
78+
$this->configurations->get("signed-requests.$requestKey.cache-prefix"),
7179
$signed->getId()
7280
);
7381

74-
$tolerance = $this->configurations->get('signed-requests.request-replay.tolerance');
82+
$tolerance = $this->configurations->get("signed-requests.$requestKey.request-replay.tolerance");
7583

76-
if (true !== $this->configurations->get('signed-requests.request-replay.allow')) {
84+
if (true !== $this->configurations->get("signed-requests.$requestKey.request-replay.allow")) {
7785
$isExpired = $signed->isExpired($tolerance);
7886

7987
if ($isExpired || $this->cache->has($key)) {
@@ -82,10 +90,10 @@ public function handle(Request $request, Closure $next)
8290
}
8391

8492
$signed
85-
->setSignatureHeader($this->configurations->get('signed-requests.headers.signature'))
86-
->setAlgorithmHeader($this->configurations->get('signed-requests.headers.algorithm'));
93+
->setSignatureHeader($this->configurations->get("signed-requests.$requestKey.headers.signature"))
94+
->setAlgorithmHeader($this->configurations->get("signed-requests.$requestKey.headers.algorithm"));
8795

88-
if (!$signed->isValid($this->configurations->get('signed-requests.key'))) {
96+
if (!$signed->isValid($this->configurations->get("signed-requests.$requestKey.key"))) {
8997
throw new InvalidSignatureException();
9098
}
9199

0 commit comments

Comments
 (0)