AutoIt Requires Chilkat v11.0.0+

Verify Signature of Alexa Custom Skill Request

See more HTTP Misc Examples

This example verifies the signature of an Alexa Custom Skill Request. AutoIt

Local $bSuccess = False

;  This example assumes you have a web service that will receive requests from Alexa.
;  A sample request sent by Alexa will look like the following:

;  Connection: Keep-Alive
;  Content-Length: 2583
;  Content-Type: application/json; charset=utf-8
;  Accept: application/json
;  Accept-Charset: utf-8
;  Host: your.web.server.com
;  User-Agent: Apache-HttpClient/4.5.x (Java/1.8.0_172)
;  Signature: dSUmPwxc9...aKAf8mpEXg==
;  SignatureCertChainUrl: https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem
;  
;  {"version":"1.0","session":{"new":true,"sessionId":"amzn1.echo-api.session.433 ... }}

;  First, assume we've written code to get the 3 pieces of data we need:
Local $signature = "dSUmPwxc9...aKAf8mpEXg=="
Local $sCertChainUrl = "https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem"
Local $sJsonBody = "{""version"":""1.0"",""session"":{""new"":true,""sessionId"":""amzn1.echo-api.session.433 ... }}"

;  To validate the signature, we do the following:

;  First, download the PEM-encoded X.509 certificate chain that Alexa used to sign the message 
$oHttp = ObjCreate("Chilkat.Http")
$oSbPem = ObjCreate("Chilkat.StringBuilder")
$bSuccess = $oHttp.QuickGetSb($sCertChainUrl,$oSbPem)
If ($bSuccess = False) Then
    ConsoleWrite($oHttp.LastErrorText & @CRLF)
    Exit
EndIf

$oPem = ObjCreate("Chilkat.Pem")
$bSuccess = $oPem.LoadPem($oSbPem.GetAsString(),"passwordNotUsed")
If ($bSuccess = False) Then
    ConsoleWrite($oPem.LastErrorText & @CRLF)
    Exit
EndIf

;  The 1st certificate should be the signing certificate.
Local $oCert = $oPem.GetCert(0)
If ($oPem.LastMethodSuccess = False) Then
    ConsoleWrite($oPem.LastErrorText & @CRLF)
    Exit
EndIf

;  Get the public key from the cert.
$oPubKey = ObjCreate("Chilkat.PublicKey")
$oCert.GetPublicKey($oPubKey)

;  Use the public key extracted from the signing certificate to decrypt the encrypted signature to produce the asserted hash value.
$oRsa = ObjCreate("Chilkat.Rsa")
$bSuccess = $oRsa.UsePublicKey($oPubKey)
If ($bSuccess = False) Then
    ConsoleWrite($oCert.LastErrorText & @CRLF)
    Exit
EndIf

;  RSA "decrypt" the signature.
;  (Amazon's documentation is confusing, because we're simply verifiying the signature against the SHA-1 hash
;  of the request body.  This happens in a single call to VerifyStringENC...)
$oRsa.EncodingMode = "base64"
Local $bVerified = $oRsa.VerifyStringENC($sJsonBody,"sha1",$signature)
If ($bVerified = True) Then
    ConsoleWrite("The signature is verified against the JSON body of the request. Yay!" & @CRLF)
Else
    ConsoleWrite("Sorry, not verified.  Crud!" & @CRLF)
EndIf