PureBasic
PureBasic
Ibanity HTTP Signature for XS2A, Isabel Connect, Ponto Connect
See more Ibanity Examples
Demonstrates how to add a Signature header for Ibanity HTTP requests.Chilkat PureBasic Downloads
IncludeFile "CkJsonObject.pb"
IncludeFile "CkDateTime.pb"
IncludeFile "CkPrivateKey.pb"
IncludeFile "CkCrypt2.pb"
IncludeFile "CkStringBuilder.pb"
IncludeFile "CkRsa.pb"
Procedure ChilkatExample()
success.i = 0
; This example requires the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.
; In order to sign your HTTP requests, you have to add 2 headers to the HTTP request: Digest: the digest of the request payload and Signature: the actual signature of the request.
; POST /xs2a/customer-access-tokens HTTP/1.1
; Host: api.ibanity.com
; Content-Type: application/json
; Digest: SHA-512=z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXcg/SpIdNs6c5H0NE8XYXysP+DGNKHfuwvY7kxvUdBeoGlODJ6+SfaPg==
; Ibanity-Idempotency-Key: 61f02718-eeee-46e1-b5eb-e8fd6e799c2d
; Signature: keyId="62f02718-eeee-46e1-b5eb-e8fd6e799c2e",created=1599659223,algorithm="hs2019",headers="(request-target) host digest (created) ibanity-idempotency-key",signature="SjWJWbWN7i0...zsbM="
;
; {"data":{"type":"customerAccessToken", "attributes":{"applicationCustomerReference":"15874569"}}}
; The payload (body) of the above HTTP request is the JSON.
; Build the JSON above.
; Use this online tool to generate code from sample JSON:
; Generate Code to Create JSON
json.i = CkJsonObject::ckCreate()
If json.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
CkJsonObject::ckUpdateString(json,"data.type","customerAccessToken")
CkJsonObject::ckUpdateString(json,"data.attributes.applicationCustomerReference","15874569")
payload.s = CkJsonObject::ckEmit(json)
Debug "payload = " + payload
; Step 1: Build the (created) virtual header
dtNow.i = CkDateTime::ckCreate()
If dtNow.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
CkDateTime::ckSetFromCurrentSystemTime(dtNow)
created.s = CkDateTime::ckGetAsUnixTimeStr(dtNow,0)
Debug "created = " + created
; Step 2: Build the Digest header
crypt.i = CkCrypt2::ckCreate()
If crypt.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
CkCrypt2::setCkHashAlgorithm(crypt, "sha512")
CkCrypt2::setCkEncodingMode(crypt, "base64")
CkCrypt2::setCkCharset(crypt, "utf-8")
sbDigestHdrValue.i = CkStringBuilder::ckCreate()
If sbDigestHdrValue.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
CkStringBuilder::ckAppend(sbDigestHdrValue,"SHA-512=")
CkStringBuilder::ckAppend(sbDigestHdrValue,CkCrypt2::ckHashStringENC(crypt,CkJsonObject::ckEmit(json)))
Debug CkStringBuilder::ckGetAsString(sbDigestHdrValue)
; Step 3: Build the (request target) virtual header
; In order to build the signature you will need a virtual header named (request-target) (the parentheses are important).
; The (request-target) is the string concatenation of the HTTP method (in lowercase) with the path and query parameters.
request_target.s = "post /xs2a/customer-access-tokens"
; Step 4: Build the signing string
; The signing string is the concatenation of the signed header names (in lowercase) and values separated by a LF.
; You must always sign the following headers: (request-target), host, (created), digest.
; If used, you must also sign the authorization header and any ibanity-* headers, such as ibanity-idempotency-key.
sbSigningString.i = CkStringBuilder::ckCreate()
If sbSigningString.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
CkStringBuilder::ckAppend(sbSigningString,"(request-target): ")
CkStringBuilder::ckAppendLine(sbSigningString,request_target,0)
CkStringBuilder::ckAppend(sbSigningString,"host: ")
CkStringBuilder::ckAppendLine(sbSigningString,"api.ibanity.com",0)
CkStringBuilder::ckAppend(sbSigningString,"digest: ")
CkStringBuilder::ckAppendLine(sbSigningString,CkStringBuilder::ckGetAsString(sbDigestHdrValue),0)
CkStringBuilder::ckAppend(sbSigningString,"(created): ")
CkStringBuilder::ckAppendLine(sbSigningString,created,0)
CkStringBuilder::ckAppend(sbSigningString,"ibanity-idempotency-key: ")
idempotencyKey.s = CkCrypt2::ckGenerateUuid(crypt)
CkStringBuilder::ckAppend(sbSigningString,idempotencyKey)
; Step 5: Build the signed headers list
; To allow Ibanity to check the signed headers, you must provide a list of the header names. They should be lowercase and in the same order used to create the signing string.
signed_headers_list.s = "(request-target) host digest (created) ibanity-idempotency-key"
; Step 6: Build the Signature header
; This is where the real signing happens. The signature header is a combination of several sub-headers -
;
; keyId: the identifier for the application's signature certificate, obtained from the Developer Portal
; algorithm: the digital signature algorithm used to generate the signature (must be hs2019)
; headers: The list of HTTP headers created in step 5
; signature: the Base64-encoded digital signature of the signing string created in step 4.
privKey.i = CkPrivateKey::ckCreate()
If privKey.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
success = CkPrivateKey::ckLoadEncryptedPemFile(privKey,"my_ibanity_signature_private_key.pem","pem_password")
If success = 0
Debug CkPrivateKey::ckLastErrorText(privKey)
CkJsonObject::ckDispose(json)
CkDateTime::ckDispose(dtNow)
CkCrypt2::ckDispose(crypt)
CkStringBuilder::ckDispose(sbDigestHdrValue)
CkStringBuilder::ckDispose(sbSigningString)
CkPrivateKey::ckDispose(privKey)
ProcedureReturn
EndIf
rsa.i = CkRsa::ckCreate()
If rsa.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
CkRsa::setCkPssSaltLen(rsa, 32)
CkRsa::setCkEncodingMode(rsa, "base64")
; Use the RSASSA-PSS signature algorithm
CkRsa::setCkPkcsPadding(rsa, 0)
success = CkRsa::ckUsePrivateKey(rsa,privKey)
If success = 0
Debug CkRsa::ckLastErrorText(rsa)
CkJsonObject::ckDispose(json)
CkDateTime::ckDispose(dtNow)
CkCrypt2::ckDispose(crypt)
CkStringBuilder::ckDispose(sbDigestHdrValue)
CkStringBuilder::ckDispose(sbSigningString)
CkPrivateKey::ckDispose(privKey)
CkRsa::ckDispose(rsa)
ProcedureReturn
EndIf
; Sign the signing string.
sigBase64.s = CkRsa::ckSignStringENC(rsa,CkStringBuilder::ckGetAsString(sbSigningString),"sha-256")
If CkRsa::ckLastMethodSuccess(rsa) = 0
Debug CkRsa::ckLastErrorText(rsa)
CkJsonObject::ckDispose(json)
CkDateTime::ckDispose(dtNow)
CkCrypt2::ckDispose(crypt)
CkStringBuilder::ckDispose(sbDigestHdrValue)
CkStringBuilder::ckDispose(sbSigningString)
CkPrivateKey::ckDispose(privKey)
CkRsa::ckDispose(rsa)
ProcedureReturn
EndIf
; Build the signature header value.
sbSigHeaderValue.i = CkStringBuilder::ckCreate()
If sbSigHeaderValue.i = 0
Debug "Failed to create object."
ProcedureReturn
EndIf
CkStringBuilder::ckAppend(sbSigHeaderValue,"keyId=" + Chr(34))
; Use your identifier for the application's signature certificate, obtained from the Developer Portal
CkStringBuilder::ckAppend(sbSigHeaderValue,"62f02718-eeee-46e1-b5eb-e8fd6e799c2e")
CkStringBuilder::ckAppend(sbSigHeaderValue,Chr(34) + ",created=")
CkStringBuilder::ckAppend(sbSigHeaderValue,created)
CkStringBuilder::ckAppend(sbSigHeaderValue,",algorithm=" + Chr(34) + "hs2019" + Chr(34) + ",headers=" + Chr(34))
CkStringBuilder::ckAppend(sbSigHeaderValue,signed_headers_list)
CkStringBuilder::ckAppend(sbSigHeaderValue,Chr(34) + ",signature=" + Chr(34))
CkStringBuilder::ckAppend(sbSigHeaderValue,sigBase64)
CkStringBuilder::ckAppend(sbSigHeaderValue,Chr(34))
Debug CkStringBuilder::ckGetAsString(sbSigHeaderValue)
CkJsonObject::ckDispose(json)
CkDateTime::ckDispose(dtNow)
CkCrypt2::ckDispose(crypt)
CkStringBuilder::ckDispose(sbDigestHdrValue)
CkStringBuilder::ckDispose(sbSigningString)
CkPrivateKey::ckDispose(privKey)
CkRsa::ckDispose(rsa)
CkStringBuilder::ckDispose(sbSigHeaderValue)
ProcedureReturn
EndProcedure