Unicode C++

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. Unicode C++

#include <CkStringBuilderW.h>
#include <CkDateTimeW.h>
#include <CkBinDataW.h>
#include <CkPrivateKeyW.h>
#include <CkEdDSAW.h>
#include <CkHttpW.h>
#include <CkHttpResponseW.h>

void ChilkatSample(void)
    {
    bool success = false;

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Ebay provides a Key Management API
    // See https://developer.ebay.com/api-docs/developer/key-management/overview.html

    // The following test keys can be used: 
    // 
    // Ed25519 
    // 
    // Private Key:
    // 
    // -----BEGIN PRIVATE KEY-----
    // MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
    // -----END PRIVATE KEY-----

    const wchar_t *strPrivateKey = L"MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF";

    // 
    // Public Key:
    // 
    // -----BEGIN PUBLIC KEY-----
    // MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
    // -----END PUBLIC KEY-----

    const wchar_t *strPublicKey = L"MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";

    // This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
    // This JWE is just for example:
    const wchar_t *strJwe = L"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw";

    CkStringBuilderW sbBody;
    sbBody.Append(L"{\"hello\": \"world\"}");

    wprintf(L"Body of request:\n");
    wprintf(L"%s\n",sbBody.getAsString());

    // -------------------------------------------------
    // Build the signature base string...

    CkStringBuilderW sbSigBase;

    sbSigBase.Append(L"\"content-digest\": sha-256=:");
    sbSigBase.Append(sbBody.getHash(L"sha256",L"base64",L"utf-8"));
    sbSigBase.Append(L":\n");

    sbSigBase.Append(L"\"x-ebay-signature-key\": ");
    sbSigBase.Append(strJwe);
    sbSigBase.Append(L"\n");

    sbSigBase.Append(L"\"@method\": POST\n");

    // This is the path part of the URL without query params...
    sbSigBase.Append(L"\"@path\": ");
    sbSigBase.Append(L"/verifysignature");
    sbSigBase.Append(L"\n");

    // The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
    // In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
    // Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
    sbSigBase.Append(L"\"@authority\": ");
    sbSigBase.Append(L"localhost:8080");
    sbSigBase.Append(L"\n");

    sbSigBase.Append(L"\"@signature-params\": ");

    CkStringBuilderW sbSigInput;
    sbSigInput.Append(L"(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")");
    sbSigInput.Append(L";created=");

    CkDateTimeW dt;
    dt.SetFromCurrentSystemTime();
    const wchar_t *unixTimeNow = dt.getAsUnixTimeStr(false);
    sbSigInput.Append(unixTimeNow);

    sbSigBase.AppendSb(sbSigInput);

    // -------------------------------------------------
    // Sign the signature base string using the Ed25519 private key

    CkBinDataW bdPrivKey;
    bdPrivKey.AppendEncoded(strPrivateKey,L"base64");

    CkPrivateKeyW privKey;
    success = privKey.LoadAnyFormat(bdPrivKey,L"");
    if (success == false) {
        wprintf(L"%s\n",privKey.lastErrorText());
        return;
    }

    CkBinDataW bdToBeSigned;
    bdToBeSigned.AppendSb(sbSigBase,L"utf-8");

    CkEdDSAW eddsa;
    const wchar_t *sigBase64 = eddsa.signBdENC(bdToBeSigned,L"base64",privKey);
    if (eddsa.get_LastMethodSuccess() == false) {
        wprintf(L"%s\n",eddsa.lastErrorText());
        return;
    }

    wprintf(L"sigBase64:\n");
    wprintf(L"%s\n",sigBase64);

    // ----------------------------------------------------------
    // Send the JSON POST

    CkHttpW http;

    http.SetRequestHeader(L"x-ebay-signature-key",strJwe);

    CkStringBuilderW sbContentDigestHdr;
    sbContentDigestHdr.Append(L"sha-256=:");
    sbContentDigestHdr.Append(sbBody.getHash(L"sha256",L"base64",L"utf-8"));
    sbContentDigestHdr.Append(L":");
    http.SetRequestHeader(L"Content-Digest",sbContentDigestHdr.getAsString());

    CkStringBuilderW sbSigHdr;
    sbSigHdr.Append(L"sig1=:");
    sbSigHdr.Append(sigBase64);
    sbSigHdr.Append(L":");
    http.SetRequestHeader(L"Signature",sbSigHdr.getAsString());

    sbSigInput.Prepend(L"sig1=");
    http.SetRequestHeader(L"Signature-Input",sbSigInput.getAsString());

    // Add this header to make eBay actually check the signature.
    http.SetRequestHeader(L"x-ebay-enforce-signature",L"true");

    // Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
    http.put_AuthToken(L"your_oauth2_access_token");

    // The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
    // Normally, you'll send your POST to some api.ebay.com endpoint.
    const wchar_t *url = L"http://localhost:8080/verifysignature";

    const wchar_t *jsonStr = sbBody.getAsString();
    CkHttpResponseW resp;
    success = http.HttpStr(L"POST",L"http://localhost:8080/verifysignature",jsonStr,L"utf-8",L"application/json",resp);
    if (success == false) {
        wprintf(L"%s\n",http.lastErrorText());
        return;
    }

    wprintf(L"Response status code: %d\n",resp.get_StatusCode());
    wprintf(L"Response body:\n");
    wprintf(L"%s\n",resp.bodyStr());
    }