Delphi ActiveX Requires Chilkat v11.0.0+

Verify Signature of Alexa Custom Skill Request

See more HTTP Misc Examples

This example verifies the signature of an Alexa Custom Skill Request. Delphi ActiveX

var
success: Integer;
signature: WideString;
certChainUrl: WideString;
jsonBody: WideString;
http: TChilkatHttp;
sbPem: TChilkatStringBuilder;
pem: TChilkatPem;
cert: IChilkatCert;
pubKey: TPublicKey;
rsa: TChilkatRsa;
bVerified: Integer;

begin
success := 0;

//  This example assumes you have a web service that will receive requests from Alexa.
//  A sample request sent by Alexa will look like the following:

//  Connection: Keep-Alive
//  Content-Length: 2583
//  Content-Type: application/json; charset=utf-8
//  Accept: application/json
//  Accept-Charset: utf-8
//  Host: your.web.server.com
//  User-Agent: Apache-HttpClient/4.5.x (Java/1.8.0_172)
//  Signature: dSUmPwxc9...aKAf8mpEXg==
//  SignatureCertChainUrl: https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem
//  
//  {"version":"1.0","session":{"new":true,"sessionId":"amzn1.echo-api.session.433 ... }}

//  First, assume we've written code to get the 3 pieces of data we need:
signature := 'dSUmPwxc9...aKAf8mpEXg==';
certChainUrl := 'https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem';
jsonBody := '{"version":"1.0","session":{"new":true,"sessionId":"amzn1.echo-api.session.433 ... }}';

//  To validate the signature, we do the following:

//  First, download the PEM-encoded X.509 certificate chain that Alexa used to sign the message 
http := TChilkatHttp.Create(Self);
sbPem := TChilkatStringBuilder.Create(Self);
success := http.QuickGetSb(certChainUrl,sbPem.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(http.LastErrorText);
    Exit;
  end;

pem := TChilkatPem.Create(Self);
success := pem.LoadPem(sbPem.GetAsString(),'passwordNotUsed');
if (success = 0) then
  begin
    Memo1.Lines.Add(pem.LastErrorText);
    Exit;
  end;

//  The 1st certificate should be the signing certificate.
cert := pem.GetCert(0);
if (pem.LastMethodSuccess = 0) then
  begin
    Memo1.Lines.Add(pem.LastErrorText);
    Exit;
  end;

//  Get the public key from the cert.
pubKey := TPublicKey.Create(Self);
cert.GetPublicKey(pubKey.ControlInterface);

//  Use the public key extracted from the signing certificate to decrypt the encrypted signature to produce the asserted hash value.
rsa := TChilkatRsa.Create(Self);
success := rsa.UsePublicKey(pubKey.ControlInterface);
if (success = 0) then
  begin
    Memo1.Lines.Add(cert.LastErrorText);
    Exit;
  end;

//  RSA "decrypt" the signature.
//  (Amazon's documentation is confusing, because we're simply verifiying the signature against the SHA-1 hash
//  of the request body.  This happens in a single call to VerifyStringENC...)
rsa.EncodingMode := 'base64';
bVerified := rsa.VerifyStringENC(jsonBody,'sha1',signature);
if (bVerified = 1) then
  begin
    Memo1.Lines.Add('The signature is verified against the JSON body of the request. Yay!');
  end
else
  begin
    Memo1.Lines.Add('Sorry, not verified.  Crud!');
  end;