kayx23 commented on code in PR #13856:
URL: https://github.com/apache/apisix/pull/13856#discussion_r3819793968
##########
docs/en/latest/plugins/hmac-auth.md:
##########
@@ -894,27 +894,29 @@ gmt_time = datetime.now(timezone.utc).strftime('%a, %d %b
%Y %H:%M:%S GMT')
# the date and any subsequent custom headers should be lowercased and
separated by a
# single space character, i.e. `<key>:<space><value>`
#
https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12#section-2.1.6
+# create the SHA-256 digest of the request body and base64 encode it
+body_digest = hashlib.sha256(body.encode('utf-8')).digest()
+body_digest_base64 = base64.b64encode(body_digest).decode('utf-8')
+digest_header = f"SHA-256={body_digest_base64}"
+
signing_string = (
f"{key_id}\n"
f"{request_method} {request_path}\n"
f"date: {gmt_time}\n"
+ f"digest: {digest_header}\n"
)
# create signature
signature = hmac.new(secret_key, signing_string.encode('utf-8'),
hashlib.sha256).digest()
signature_base64 = base64.b64encode(signature).decode('utf-8')
-# create the SHA-256 digest of the request body and base64 encode it
-body_digest = hashlib.sha256(body.encode('utf-8')).digest()
-body_digest_base64 = base64.b64encode(body_digest).decode('utf-8')
-
# construct the request headers
headers = {
"Date": gmt_time,
- "Digest": f"SHA-256={body_digest_base64}",
+ "Digest": digest_header,
"Authorization": (
f'Signature keyId="{key_id}",algorithm="hmac-sha256",'
- f'headers="@request-target date",'
+ f'headers="@request-target date digest",'
Review Comment:
This now produces `headers="@request-target date digest"`, but the frozen
sample output, success `curl`, and response body below still use
`headers="@request-target date"` and
`signature="rjS6NxOBKmzS8CZL05uLiAfE16hXdIpMD/L/HukOTYE="`.
For the documented timestamp `Fri, 06 Sep 2024 09:16:16 GMT`, the script
prints:
```text
headers="@request-target date digest"
signature="LGBTz7bVQQWlkijeyDpEwJWo+ppwX735uRZk5F8KhmU="
```
Please refresh those samples (issue item 4). A short note that
`validate_request_body` only checks `Digest` against the body — and that
signing `digest` is what binds the body to the HMAC — would also match the
issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
