Unicode C
Unicode C
ebay: Add Digital Signature to HTTP Request
See more eBay Examples
Demonstrates how to add a digital signature to an ebay HTTP request.Chilkat Unicode C Downloads
#include <C_CkStringBuilderW.h>
#include <C_CkDateTimeW.h>
#include <C_CkBinDataW.h>
#include <C_CkPrivateKeyW.h>
#include <C_CkEdDSAW.h>
#include <C_CkHttpW.h>
#include <C_CkHttpResponseW.h>
void ChilkatSample(void)
{
BOOL success;
const wchar_t *strPrivateKey;
const wchar_t *strPublicKey;
const wchar_t *strJwe;
HCkStringBuilderW sbBody;
HCkStringBuilderW sbSigBase;
HCkStringBuilderW sbSigInput;
HCkDateTimeW dt;
const wchar_t *unixTimeNow;
HCkBinDataW bdPrivKey;
HCkPrivateKeyW privKey;
HCkBinDataW bdToBeSigned;
HCkEdDSAW eddsa;
const wchar_t *sigBase64;
HCkHttpW http;
HCkStringBuilderW sbContentDigestHdr;
HCkStringBuilderW sbSigHdr;
const wchar_t *url;
const wchar_t *jsonStr;
HCkHttpResponseW resp;
success = FALSE;
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// Note: Ebay provides a Key Management API
// See https://developer.ebay.com/api-docs/developer/key-management/overview.html
// The following test keys can be used:
//
// Ed25519
//
// Private Key:
//
// -----BEGIN PRIVATE KEY-----
// MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
// -----END PRIVATE KEY-----
strPrivateKey = L"MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF";
//
// Public Key:
//
// -----BEGIN PUBLIC KEY-----
// MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
// -----END PUBLIC KEY-----
strPublicKey = L"MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";
// This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
// This JWE is just for example:
strJwe = L"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw";
sbBody = CkStringBuilderW_Create();
CkStringBuilderW_Append(sbBody,L"{\"hello\": \"world\"}");
wprintf(L"Body of request:\n");
wprintf(L"%s\n",CkStringBuilderW_getAsString(sbBody));
// -------------------------------------------------
// Build the signature base string...
sbSigBase = CkStringBuilderW_Create();
CkStringBuilderW_Append(sbSigBase,L"\"content-digest\": sha-256=:");
CkStringBuilderW_Append(sbSigBase,CkStringBuilderW_getHash(sbBody,L"sha256",L"base64",L"utf-8"));
CkStringBuilderW_Append(sbSigBase,L":\n");
CkStringBuilderW_Append(sbSigBase,L"\"x-ebay-signature-key\": ");
CkStringBuilderW_Append(sbSigBase,strJwe);
CkStringBuilderW_Append(sbSigBase,L"\n");
CkStringBuilderW_Append(sbSigBase,L"\"@method\": POST\n");
// This is the path part of the URL without query params...
CkStringBuilderW_Append(sbSigBase,L"\"@path\": ");
CkStringBuilderW_Append(sbSigBase,L"/verifysignature");
CkStringBuilderW_Append(sbSigBase,L"\n");
// The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
// In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
// Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
CkStringBuilderW_Append(sbSigBase,L"\"@authority\": ");
CkStringBuilderW_Append(sbSigBase,L"localhost:8080");
CkStringBuilderW_Append(sbSigBase,L"\n");
CkStringBuilderW_Append(sbSigBase,L"\"@signature-params\": ");
sbSigInput = CkStringBuilderW_Create();
CkStringBuilderW_Append(sbSigInput,L"(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")");
CkStringBuilderW_Append(sbSigInput,L";created=");
dt = CkDateTimeW_Create();
CkDateTimeW_SetFromCurrentSystemTime(dt);
unixTimeNow = CkDateTimeW_getAsUnixTimeStr(dt,FALSE);
CkStringBuilderW_Append(sbSigInput,unixTimeNow);
CkStringBuilderW_AppendSb(sbSigBase,sbSigInput);
// -------------------------------------------------
// Sign the signature base string using the Ed25519 private key
bdPrivKey = CkBinDataW_Create();
CkBinDataW_AppendEncoded(bdPrivKey,strPrivateKey,L"base64");
privKey = CkPrivateKeyW_Create();
success = CkPrivateKeyW_LoadAnyFormat(privKey,bdPrivKey,L"");
if (success == FALSE) {
wprintf(L"%s\n",CkPrivateKeyW_lastErrorText(privKey));
CkStringBuilderW_Dispose(sbBody);
CkStringBuilderW_Dispose(sbSigBase);
CkStringBuilderW_Dispose(sbSigInput);
CkDateTimeW_Dispose(dt);
CkBinDataW_Dispose(bdPrivKey);
CkPrivateKeyW_Dispose(privKey);
return;
}
bdToBeSigned = CkBinDataW_Create();
CkBinDataW_AppendSb(bdToBeSigned,sbSigBase,L"utf-8");
eddsa = CkEdDSAW_Create();
sigBase64 = CkEdDSAW_signBdENC(eddsa,bdToBeSigned,L"base64",privKey);
if (CkEdDSAW_getLastMethodSuccess(eddsa) == FALSE) {
wprintf(L"%s\n",CkEdDSAW_lastErrorText(eddsa));
CkStringBuilderW_Dispose(sbBody);
CkStringBuilderW_Dispose(sbSigBase);
CkStringBuilderW_Dispose(sbSigInput);
CkDateTimeW_Dispose(dt);
CkBinDataW_Dispose(bdPrivKey);
CkPrivateKeyW_Dispose(privKey);
CkBinDataW_Dispose(bdToBeSigned);
CkEdDSAW_Dispose(eddsa);
return;
}
wprintf(L"sigBase64:\n");
wprintf(L"%s\n",sigBase64);
// ----------------------------------------------------------
// Send the JSON POST
http = CkHttpW_Create();
CkHttpW_SetRequestHeader(http,L"x-ebay-signature-key",strJwe);
sbContentDigestHdr = CkStringBuilderW_Create();
CkStringBuilderW_Append(sbContentDigestHdr,L"sha-256=:");
CkStringBuilderW_Append(sbContentDigestHdr,CkStringBuilderW_getHash(sbBody,L"sha256",L"base64",L"utf-8"));
CkStringBuilderW_Append(sbContentDigestHdr,L":");
CkHttpW_SetRequestHeader(http,L"Content-Digest",CkStringBuilderW_getAsString(sbContentDigestHdr));
sbSigHdr = CkStringBuilderW_Create();
CkStringBuilderW_Append(sbSigHdr,L"sig1=:");
CkStringBuilderW_Append(sbSigHdr,sigBase64);
CkStringBuilderW_Append(sbSigHdr,L":");
CkHttpW_SetRequestHeader(http,L"Signature",CkStringBuilderW_getAsString(sbSigHdr));
CkStringBuilderW_Prepend(sbSigInput,L"sig1=");
CkHttpW_SetRequestHeader(http,L"Signature-Input",CkStringBuilderW_getAsString(sbSigInput));
// Add this header to make eBay actually check the signature.
CkHttpW_SetRequestHeader(http,L"x-ebay-enforce-signature",L"true");
// Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
CkHttpW_putAuthToken(http,L"your_oauth2_access_token");
// The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
// Normally, you'll send your POST to some api.ebay.com endpoint.
url = L"http://localhost:8080/verifysignature";
jsonStr = CkStringBuilderW_getAsString(sbBody);
resp = CkHttpResponseW_Create();
success = CkHttpW_HttpStr(http,L"POST",L"http://localhost:8080/verifysignature",jsonStr,L"utf-8",L"application/json",resp);
if (success == FALSE) {
wprintf(L"%s\n",CkHttpW_lastErrorText(http));
CkStringBuilderW_Dispose(sbBody);
CkStringBuilderW_Dispose(sbSigBase);
CkStringBuilderW_Dispose(sbSigInput);
CkDateTimeW_Dispose(dt);
CkBinDataW_Dispose(bdPrivKey);
CkPrivateKeyW_Dispose(privKey);
CkBinDataW_Dispose(bdToBeSigned);
CkEdDSAW_Dispose(eddsa);
CkHttpW_Dispose(http);
CkStringBuilderW_Dispose(sbContentDigestHdr);
CkStringBuilderW_Dispose(sbSigHdr);
CkHttpResponseW_Dispose(resp);
return;
}
wprintf(L"Response status code: %d\n",CkHttpResponseW_getStatusCode(resp));
wprintf(L"Response body:\n");
wprintf(L"%s\n",CkHttpResponseW_bodyStr(resp));
CkStringBuilderW_Dispose(sbBody);
CkStringBuilderW_Dispose(sbSigBase);
CkStringBuilderW_Dispose(sbSigInput);
CkDateTimeW_Dispose(dt);
CkBinDataW_Dispose(bdPrivKey);
CkPrivateKeyW_Dispose(privKey);
CkBinDataW_Dispose(bdToBeSigned);
CkEdDSAW_Dispose(eddsa);
CkHttpW_Dispose(http);
CkStringBuilderW_Dispose(sbContentDigestHdr);
CkStringBuilderW_Dispose(sbSigHdr);
CkHttpResponseW_Dispose(resp);
}