(C#) Verify Signature of Alexa Custom Skill Request

This example verifies the signature of an Alexa Custom Skill Request.

Chilkat .NET Downloads Chilkat .NET Framework Chilkat for .NET Core

// This example assumes you have a web service that will receive requests from Alexa.
// A sample request sent by Alexa will look like the following:

// Connection: Keep-Alive
// Content-Length: 2583
// Content-Type: application/json; charset=utf-8
// Accept: application/json
// Accept-Charset: utf-8
// Host: your.web.server.com
// User-Agent: Apache-HttpClient/4.5.x (Java/1.8.0_172)
// Signature: dSUmPwxc9...aKAf8mpEXg==
// SignatureCertChainUrl: https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem
// 
// {"version":"1.0","session":{"new":true,"sessionId":"amzn1.echo-api.session.433 ... }}

// First, assume we've written code to get the 3 pieces of data we need:
string signature = "dSUmPwxc9...aKAf8mpEXg==";
string certChainUrl = "https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem";
string jsonBody = "{\"version\":\"1.0\",\"session\":{\"new\":true,\"sessionId\":\"amzn1.echo-api.session.433 ... }}";

// To validate the signature, we do the following:

// First, download the PEM-encoded X.509 certificate chain that Alexa used to sign the message 
Chilkat.Http http = new Chilkat.Http();
Chilkat.StringBuilder sbPem = new Chilkat.StringBuilder();
bool success = http.QuickGetSb(certChainUrl,sbPem);
if (success == false) {
    Debug.WriteLine(http.LastErrorText);
    return;
}

Chilkat.Pem pem = new Chilkat.Pem();
success = pem.LoadPem(sbPem.GetAsString(),"passwordNotUsed");
if (success == false) {
    Debug.WriteLine(pem.LastErrorText);
    return;
}

// The 1st certificate should be the signing certificate.
Chilkat.Cert cert = pem.GetCert(0);
if (pem.LastMethodSuccess == false) {
    Debug.WriteLine(pem.LastErrorText);
    return;
}

// Get the public key from the cert.
Chilkat.PublicKey pubKey = cert.ExportPublicKey();
if (cert.LastMethodSuccess == false) {
    Debug.WriteLine(cert.LastErrorText);

    return;
}

// Use the public key extracted from the signing certificate to decrypt the encrypted signature to produce the asserted hash value.
Chilkat.Rsa rsa = new Chilkat.Rsa();
success = rsa.ImportPublicKeyObj(pubKey);
if (success == false) {
    Debug.WriteLine(cert.LastErrorText);

    return;
}

// RSA "decrypt" the signature.
// (Amazon's documentation is confusing, because we're simply verifiying the signature against the SHA-1 hash
// of the request body.  This happens in a single call to VerifyStringENC...)
rsa.EncodingMode = "base64";
bool bVerified = rsa.VerifyStringENC(jsonBody,"sha1",signature);
if (bVerified == true) {
    Debug.WriteLine("The signature is verified against the JSON body of the request. Yay!");
}
else {
    Debug.WriteLine("Sorry, not verified.  Crud!");
}