Lua

Plaza API (bol.com) HMAC-SHA256 Authentication

See more Encryption Examples

Demonstrates how to compute the Authorization header for bol.com using HMAC-SHA256. Lua

local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()

crypt.encoding_mode = "base64"
crypt.hash_algorithm = "sha256"
crypt.mac_algorithm = "hmac"

local publicKey = "oRNWbHFXtAECmhnZmEndcjLIaSKbRMVE"
local privateKey = "MaQHPOnmYkPZNgeRziPnQyyOJYytUbcFBVJBvbMKoDdpPqaZbaOiLUTWzPAkpPsZFZbJHrcoltdgpZolyNcgvvBaKcmkqFjucFzXhDONTsPAtHHyccQlLUZpkOuywMiOycDWcCySFsgpDiyGnCWCZJkNTtVdPxbSUTWVIFQiUxaPDYDXRQAVVTbSVZArAZkaLDLOoOvPzxSdhnkkJWzlQDkqsXNKfAIgAldrmyfROSyCGMCfvzdQdUQEaYZTPEoA"

-- The string to sign is this:
-- http_verb +'\n\n'+ content_type +'\n'+ x_bol_date +'\n'+ 'x-bol-date:'+ x_bol_date +'\n'+ uri

local http_verb = "GET"
local content_type = "application/xml"
local x_bol_date = "Wed, 17 Feb 2016 00:00:00 GMT"
local uri = "/services/rest/orders/v2"

-- IMPORTANT: Notice the use of underscore and hyphen (dash) chars in x-bol-date vs. x_bol_date.
-- In one place hypens are used.  In two places, underscore chars are used.
local sb = chilkat.StringBuilder.new()
sb:append(http_verb)
sb:append("\n\n")
sb:append(content_type)
sb:append("\n")
sb:append(x_bol_date)
sb:append("\nx-bol-date:")
sb:append(x_bol_date)
sb:append("\n")
sb:append(uri)
print("[" .. sb:get_as_string() .. "]")

-- Set the HMAC key:
crypt:set_mac_key_encoded(privateKey, "ascii")
local mac = crypt:mac_string_enc(sb:get_as_string())

-- The answer should be: nqzLWvXI1eBhBXrRx5NF23V5hS8Q1xWCloJzPi/RAts=
print(mac)

-- The last step is to append the public key with the signature
local sbHeader = chilkat.StringBuilder.new()
sbHeader:append(publicKey)
sbHeader:append(":")
sbHeader:append(mac)

local hdrValue = sbHeader:get_as_string()
print(hdrValue)