Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How would one set a keyid (or other parameters) in the Signature-Input header? #13

Open
TurboEncabulator9000 opened this issue Jun 28, 2023 · 2 comments
Labels
enhancement New feature or request

Comments

@TurboEncabulator9000
Copy link

The signature parameters segment of Signature-Input is specified to support the following parameters:

  • created
  • expires
  • nonce
  • alg
  • keyid
  • tag

In the code (signature-base-helper.generateBase()), it seems that the created field is automatically appended, and there's no support for the other fields.

If I try to wrap the library like this...

    headers["Signature-Input"] = DigitalSignatureSDK.generateSignatureInput(
      headers,
      config,
    ) + `;keyid="some-key-id"`;

...I can append whatever I want. However, signature-helper.generateSignature() will then re-generate the base string using signature-base-helper.generateBase(), overwriting whatever I added to it previously, and sign that instead. Therefore, whatever I append myself to Signature-Input (like keyid) will not be represented in the signature, and will fail verification on the receiving endpoint.

It's possible to pass keyid in a separate header, but that seems messy. Is there a way to pass this in the Signature-Input header?

@LokeshRishi
Copy link
Collaborator

@TurboEncabulator9000 The x-ebay-signature-key header already contains the encrypted keyid. Could you please provide more information about your specific use case?

@TurboEncabulator9000
Copy link
Author

For use with servers other than eBay. (I realize this may not be a very high priority for this project.)

@LokeshRishi LokeshRishi added the enhancement New feature or request label Aug 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants