C
C
ebay: Add Digital Signature to HTTP Request
See more eBay Examples
Demonstrates how to add a digital signature to an ebay HTTP request.Chilkat C Downloads
#include <C_CkStringBuilder.h>
#include <C_CkDateTime.h>
#include <C_CkBinData.h>
#include <C_CkPrivateKey.h>
#include <C_CkEdDSA.h>
#include <C_CkHttp.h>
#include <C_CkHttpResponse.h>
void ChilkatSample(void)
{
BOOL success;
const char *strPrivateKey;
const char *strPublicKey;
const char *strJwe;
HCkStringBuilder sbBody;
HCkStringBuilder sbSigBase;
HCkStringBuilder sbSigInput;
HCkDateTime dt;
const char *unixTimeNow;
HCkBinData bdPrivKey;
HCkPrivateKey privKey;
HCkBinData bdToBeSigned;
HCkEdDSA eddsa;
const char *sigBase64;
HCkHttp http;
HCkStringBuilder sbContentDigestHdr;
HCkStringBuilder sbSigHdr;
const char *url;
const char *jsonStr;
HCkHttpResponse resp;
success = FALSE;
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// Note: Ebay provides a Key Management API
// See https://developer.ebay.com/api-docs/developer/key-management/overview.html
// The following test keys can be used:
//
// Ed25519
//
// Private Key:
//
// -----BEGIN PRIVATE KEY-----
// MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
// -----END PRIVATE KEY-----
strPrivateKey = "MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF";
//
// Public Key:
//
// -----BEGIN PUBLIC KEY-----
// MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
// -----END PUBLIC KEY-----
strPublicKey = "MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";
// This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
// This JWE is just for example:
strJwe = "eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw";
sbBody = CkStringBuilder_Create();
CkStringBuilder_Append(sbBody,"{\"hello\": \"world\"}");
printf("Body of request:\n");
printf("%s\n",CkStringBuilder_getAsString(sbBody));
// -------------------------------------------------
// Build the signature base string...
sbSigBase = CkStringBuilder_Create();
CkStringBuilder_Append(sbSigBase,"\"content-digest\": sha-256=:");
CkStringBuilder_Append(sbSigBase,CkStringBuilder_getHash(sbBody,"sha256","base64","utf-8"));
CkStringBuilder_Append(sbSigBase,":\n");
CkStringBuilder_Append(sbSigBase,"\"x-ebay-signature-key\": ");
CkStringBuilder_Append(sbSigBase,strJwe);
CkStringBuilder_Append(sbSigBase,"\n");
CkStringBuilder_Append(sbSigBase,"\"@method\": POST\n");
// This is the path part of the URL without query params...
CkStringBuilder_Append(sbSigBase,"\"@path\": ");
CkStringBuilder_Append(sbSigBase,"/verifysignature");
CkStringBuilder_Append(sbSigBase,"\n");
// The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
// In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
// Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
CkStringBuilder_Append(sbSigBase,"\"@authority\": ");
CkStringBuilder_Append(sbSigBase,"localhost:8080");
CkStringBuilder_Append(sbSigBase,"\n");
CkStringBuilder_Append(sbSigBase,"\"@signature-params\": ");
sbSigInput = CkStringBuilder_Create();
CkStringBuilder_Append(sbSigInput,"(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")");
CkStringBuilder_Append(sbSigInput,";created=");
dt = CkDateTime_Create();
CkDateTime_SetFromCurrentSystemTime(dt);
unixTimeNow = CkDateTime_getAsUnixTimeStr(dt,FALSE);
CkStringBuilder_Append(sbSigInput,unixTimeNow);
CkStringBuilder_AppendSb(sbSigBase,sbSigInput);
// -------------------------------------------------
// Sign the signature base string using the Ed25519 private key
bdPrivKey = CkBinData_Create();
CkBinData_AppendEncoded(bdPrivKey,strPrivateKey,"base64");
privKey = CkPrivateKey_Create();
success = CkPrivateKey_LoadAnyFormat(privKey,bdPrivKey,"");
if (success == FALSE) {
printf("%s\n",CkPrivateKey_lastErrorText(privKey));
CkStringBuilder_Dispose(sbBody);
CkStringBuilder_Dispose(sbSigBase);
CkStringBuilder_Dispose(sbSigInput);
CkDateTime_Dispose(dt);
CkBinData_Dispose(bdPrivKey);
CkPrivateKey_Dispose(privKey);
return;
}
bdToBeSigned = CkBinData_Create();
CkBinData_AppendSb(bdToBeSigned,sbSigBase,"utf-8");
eddsa = CkEdDSA_Create();
sigBase64 = CkEdDSA_signBdENC(eddsa,bdToBeSigned,"base64",privKey);
if (CkEdDSA_getLastMethodSuccess(eddsa) == FALSE) {
printf("%s\n",CkEdDSA_lastErrorText(eddsa));
CkStringBuilder_Dispose(sbBody);
CkStringBuilder_Dispose(sbSigBase);
CkStringBuilder_Dispose(sbSigInput);
CkDateTime_Dispose(dt);
CkBinData_Dispose(bdPrivKey);
CkPrivateKey_Dispose(privKey);
CkBinData_Dispose(bdToBeSigned);
CkEdDSA_Dispose(eddsa);
return;
}
printf("sigBase64:\n");
printf("%s\n",sigBase64);
// ----------------------------------------------------------
// Send the JSON POST
http = CkHttp_Create();
CkHttp_SetRequestHeader(http,"x-ebay-signature-key",strJwe);
sbContentDigestHdr = CkStringBuilder_Create();
CkStringBuilder_Append(sbContentDigestHdr,"sha-256=:");
CkStringBuilder_Append(sbContentDigestHdr,CkStringBuilder_getHash(sbBody,"sha256","base64","utf-8"));
CkStringBuilder_Append(sbContentDigestHdr,":");
CkHttp_SetRequestHeader(http,"Content-Digest",CkStringBuilder_getAsString(sbContentDigestHdr));
sbSigHdr = CkStringBuilder_Create();
CkStringBuilder_Append(sbSigHdr,"sig1=:");
CkStringBuilder_Append(sbSigHdr,sigBase64);
CkStringBuilder_Append(sbSigHdr,":");
CkHttp_SetRequestHeader(http,"Signature",CkStringBuilder_getAsString(sbSigHdr));
CkStringBuilder_Prepend(sbSigInput,"sig1=");
CkHttp_SetRequestHeader(http,"Signature-Input",CkStringBuilder_getAsString(sbSigInput));
// Add this header to make eBay actually check the signature.
CkHttp_SetRequestHeader(http,"x-ebay-enforce-signature","true");
// Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
CkHttp_putAuthToken(http,"your_oauth2_access_token");
// The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
// Normally, you'll send your POST to some api.ebay.com endpoint.
url = "http://localhost:8080/verifysignature";
jsonStr = CkStringBuilder_getAsString(sbBody);
resp = CkHttpResponse_Create();
success = CkHttp_HttpStr(http,"POST","http://localhost:8080/verifysignature",jsonStr,"utf-8","application/json",resp);
if (success == FALSE) {
printf("%s\n",CkHttp_lastErrorText(http));
CkStringBuilder_Dispose(sbBody);
CkStringBuilder_Dispose(sbSigBase);
CkStringBuilder_Dispose(sbSigInput);
CkDateTime_Dispose(dt);
CkBinData_Dispose(bdPrivKey);
CkPrivateKey_Dispose(privKey);
CkBinData_Dispose(bdToBeSigned);
CkEdDSA_Dispose(eddsa);
CkHttp_Dispose(http);
CkStringBuilder_Dispose(sbContentDigestHdr);
CkStringBuilder_Dispose(sbSigHdr);
CkHttpResponse_Dispose(resp);
return;
}
printf("Response status code: %d\n",CkHttpResponse_getStatusCode(resp));
printf("Response body:\n");
printf("%s\n",CkHttpResponse_bodyStr(resp));
CkStringBuilder_Dispose(sbBody);
CkStringBuilder_Dispose(sbSigBase);
CkStringBuilder_Dispose(sbSigInput);
CkDateTime_Dispose(dt);
CkBinData_Dispose(bdPrivKey);
CkPrivateKey_Dispose(privKey);
CkBinData_Dispose(bdToBeSigned);
CkEdDSA_Dispose(eddsa);
CkHttp_Dispose(http);
CkStringBuilder_Dispose(sbContentDigestHdr);
CkStringBuilder_Dispose(sbSigHdr);
CkHttpResponse_Dispose(resp);
}