SolarPath 发出的请求 Header 中包含一串签名内容。它是用您的签名密钥将请求的 Body (JSON格式) 部分进行 HMAC SHA256 哈希算法生成。
为验证签名来自 SolarPath,请将您生成 HMAC SHA256 哈希与收到的签名进行比较。
Header中包含: x-sp-signature 的名称签名内容
示例请求Header
// request header
POST /yourApp.com/webhook HTTP/1.1
content-type: application/json;
x-sp-signature: signature-hash
示例签名验证
import*as crypto from"crypto";functionvalidationSignature( body:string,// JSON from request body signature:string,// "x-sp-signature" from header signingKey:string// taken from dashboard for specific app eventhook ):boolean {consthmac=crypto.createHmac("sha256", signingKey); // Create a HMAC SHA256 hashhmac.update(body,"utf8"); // Update the token hash with the request body using utf8constresult=hmac.digest("base64");return signature === result;}
// from request headerString signature4header =request.getHeader("x-sp-signature");// JSON from request bodyString body ="";// taken from dashboard for specific app eventhookString signingKey ="";// signatureMac sha256Hmac =Mac.getInstance("HmacSHA256");SecretKeySpec secretKeySpec =newSecretKeySpec(signingKey.getBytes(StandardCharsets.UTF_8),"HmacSHA256");sha256Hmac.init(secretKeySpec);byte[] bytes =sha256Hmac.doFinal(body.getBytes(StandardCharsets.UTF_8));String result =Base64.encodeBase64String(bytes);// validationreturnStringUtils.equals(signature4header, result);// false or true
funcvalidationSignature( body string, // JSON from request body signature string, // "x-sp-signature" from header signingKey string// taken from dashboard for specific app eventhook) bool { h := hmac.New(sha256.New, []byte(signingKey)) h.Write([]byte(body)) digest := base64.StdEncoding.EncodeToString(h.Sum(nil))return digest == signature}
import hmacimport hashlibdefvalidation_signature(body:str,# JSON from request bodysignature:str,# "x-sp-signature" from headersigning_key:str# taken from dashboard for specific app eventhook) ->bool: digest = hmac.new(bytes(signing_key, "utf-8"), msg=bytes(body, "utf-8"), digestmod=hashlib.sha256 ).digest() base64sha256 =str(base64.b64encode(digest), 'utf-8')return signature == base64sha256