(Classic ASP) ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request.

For more information, see https://developer.ebay.com/develop/guides/digital-signatures-for-apis

Chilkat ActiveX Downloads

ActiveX for 32-bit and 64-bit Windows

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<%
' This example requires the Chilkat API to have been previously unlocked.
' See Global Unlock Sample for sample code.

' Note: Ebay provides a Key Management API
' See https://developer.ebay.com/api-docs/developer/key-management/overview.html

' The following test keys can be used: 
' 
' Ed25519 
' 
' Private Key:
' 
' -----BEGIN PRIVATE KEY-----
' MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
' -----END PRIVATE KEY-----

strPrivateKey = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"

' 
' Public Key:
' 
' -----BEGIN PUBLIC KEY-----
' MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
' -----END PUBLIC KEY-----

strPublicKey = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="

' This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
' This JWE is just for example:
strJwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.StringBuilder")
set sbBody = Server.CreateObject("Chilkat.StringBuilder")
success = sbBody.Append("{""hello"": ""world""}")

Response.Write "<pre>" & Server.HTMLEncode( "Body of request:") & "</pre>"
Response.Write "<pre>" & Server.HTMLEncode( sbBody.GetAsString()) & "</pre>"

' -------------------------------------------------
' Build the signature base string...

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.StringBuilder")
set sbSigBase = Server.CreateObject("Chilkat.StringBuilder")

success = sbSigBase.Append("""content-digest"": sha-256=:")
success = sbSigBase.Append(sbBody.GetHash("sha256","base64","utf-8"))
success = sbSigBase.Append(":" & vbLf)

success = sbSigBase.Append("""x-ebay-signature-key"": ")
success = sbSigBase.Append(strJwe)
success = sbSigBase.Append(vbLf)

success = sbSigBase.Append("""@method"": POST" & vbLf)

' This is the path part of the URL without query params...
success = sbSigBase.Append("""@path"": ")
success = sbSigBase.Append("/verifysignature")
success = sbSigBase.Append(vbLf)

' The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
' In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
' Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
success = sbSigBase.Append("""@authority"": ")
success = sbSigBase.Append("localhost:8080")
success = sbSigBase.Append(vbLf)

success = sbSigBase.Append("""@signature-params"": ")

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.StringBuilder")
set sbSigInput = Server.CreateObject("Chilkat.StringBuilder")
success = sbSigInput.Append("(""content-digest"" ""x-ebay-signature-key"" ""@method"" ""@path"" ""@authority"")")
success = sbSigInput.Append(";created=")

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.CkDateTime")
set dt = Server.CreateObject("Chilkat.CkDateTime")
success = dt.SetFromCurrentSystemTime()
unixTimeNow = dt.GetAsUnixTimeStr(0)
success = sbSigInput.Append(unixTimeNow)

success = sbSigBase.AppendSb(sbSigInput)

' -------------------------------------------------
' Sign the signature base string using the Ed25519 private key

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.BinData")
set bdPrivKey = Server.CreateObject("Chilkat.BinData")
success = bdPrivKey.AppendEncoded(strPrivateKey,"base64")

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.PrivateKey")
set privKey = Server.CreateObject("Chilkat.PrivateKey")
success = privKey.LoadAnyFormat(bdPrivKey,"")
If (success = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( privKey.LastErrorText) & "</pre>"
    Response.End
End If

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.BinData")
set bdToBeSigned = Server.CreateObject("Chilkat.BinData")
success = bdToBeSigned.AppendSb(sbSigBase,"utf-8")

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.EdDSA")
set eddsa = Server.CreateObject("Chilkat.EdDSA")
sigBase64 = eddsa.SignBdENC(bdToBeSigned,"base64",privKey)
If (eddsa.LastMethodSuccess = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( eddsa.LastErrorText) & "</pre>"
    Response.End
End If

Response.Write "<pre>" & Server.HTMLEncode( "sigBase64:") & "</pre>"
Response.Write "<pre>" & Server.HTMLEncode( sigBase64) & "</pre>"

' ----------------------------------------------------------
' Send the JSON POST

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.Http")
set http = Server.CreateObject("Chilkat.Http")

http.SetRequestHeader "x-ebay-signature-key",strJwe

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.StringBuilder")
set sbContentDigestHdr = Server.CreateObject("Chilkat.StringBuilder")
success = sbContentDigestHdr.Append("sha-256=:")
success = sbContentDigestHdr.Append(sbBody.GetHash("sha256","base64","utf-8"))
success = sbContentDigestHdr.Append(":")
http.SetRequestHeader "Content-Digest",sbContentDigestHdr.GetAsString()

' For versions of Chilkat < 10.0.0, use CreateObject("Chilkat_9_5_0.StringBuilder")
set sbSigHdr = Server.CreateObject("Chilkat.StringBuilder")
success = sbSigHdr.Append("sig1=:")
success = sbSigHdr.Append(sigBase64)
success = sbSigHdr.Append(":")
http.SetRequestHeader "Signature",sbSigHdr.GetAsString()

success = sbSigInput.Prepend("sig1=")
http.SetRequestHeader "Signature-Input",sbSigInput.GetAsString()

' Add this header to make eBay actually check the signature.
http.SetRequestHeader "x-ebay-enforce-signature","true"

' Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
http.AuthToken = "your_oauth2_access_token"

' The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
' Normally, you'll send your POST to some api.ebay.com endpoint.
url = "http://localhost:8080/verifysignature"

' resp is a Chilkat.HttpResponse
Set resp = http.PostJson2("http://localhost:8080/verifysignature","application/json",sbBody.GetAsString())
If (http.LastMethodSuccess = 0) Then
    Response.Write "<pre>" & Server.HTMLEncode( http.LastErrorText) & "</pre>"
    Response.End
End If

Response.Write "<pre>" & Server.HTMLEncode( "Response status code: " & resp.StatusCode) & "</pre>"
Response.Write "<pre>" & Server.HTMLEncode( "Response body:") & "</pre>"
Response.Write "<pre>" & Server.HTMLEncode( resp.BodyStr) & "</pre>"


%>
</body>
</html>