Chilkat HOME .NET Core C# Android™ AutoIt C C# C++ Chilkat2-Python CkPython Classic ASP DataFlex Delphi ActiveX Delphi DLL Go Java Lianja Mono C# Node.js Objective-C PHP ActiveX PHP Extension Perl PowerBuilder PowerShell PureBasic Ruby SQL Server Swift 2 Swift 3,4,5... Tcl Unicode C Unicode C++ VB.NET VBScript Visual Basic 6.0 Visual FoxPro Xojo Plugin
(Unicode C) ebay: Add Digital Signature to HTTP RequestSee more eBay ExamplesDemonstrates how to add a digital signature to an ebay HTTP request. For more information, see https://developer.ebay.com/develop/guides/digital-signatures-for-apis
#include <C_CkStringBuilderW.h> #include <C_CkDateTimeW.h> #include <C_CkBinDataW.h> #include <C_CkPrivateKeyW.h> #include <C_CkEdDSAW.h> #include <C_CkHttpW.h> #include <C_CkHttpResponseW.h> void ChilkatSample(void) { BOOL success; const wchar_t *strPrivateKey; const wchar_t *strPublicKey; const wchar_t *strJwe; HCkStringBuilderW sbBody; HCkStringBuilderW sbSigBase; HCkStringBuilderW sbSigInput; HCkDateTimeW dt; const wchar_t *unixTimeNow; HCkBinDataW bdPrivKey; HCkPrivateKeyW privKey; HCkBinDataW bdToBeSigned; HCkEdDSAW eddsa; const wchar_t *sigBase64; HCkHttpW http; HCkStringBuilderW sbContentDigestHdr; HCkStringBuilderW sbSigHdr; const wchar_t *url; HCkHttpResponseW resp; // This example requires the Chilkat API to have been previously unlocked. // See Global Unlock Sample for sample code. // Note: Ebay provides a Key Management API // See https://developer.ebay.com/api-docs/developer/key-management/overview.html // The following test keys can be used: // // Ed25519 // // Private Key: // // -----BEGIN PRIVATE KEY----- // MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF // -----END PRIVATE KEY----- strPrivateKey = L"MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF"; // // Public Key: // // -----BEGIN PUBLIC KEY----- // MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs= // -----END PUBLIC KEY----- strPublicKey = L"MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs="; // This example assumes you got a JWE for your given private key from the Ebay Key Management REST API. // This JWE is just for example: strJwe = L"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw"; sbBody = CkStringBuilderW_Create(); CkStringBuilderW_Append(sbBody,L"{\"hello\": \"world\"}"); wprintf(L"Body of request:\n"); wprintf(L"%s\n",CkStringBuilderW_getAsString(sbBody)); // ------------------------------------------------- // Build the signature base string... sbSigBase = CkStringBuilderW_Create(); CkStringBuilderW_Append(sbSigBase,L"\"content-digest\": sha-256=:"); CkStringBuilderW_Append(sbSigBase,CkStringBuilderW_getHash(sbBody,L"sha256",L"base64",L"utf-8")); CkStringBuilderW_Append(sbSigBase,L":\n"); CkStringBuilderW_Append(sbSigBase,L"\"x-ebay-signature-key\": "); CkStringBuilderW_Append(sbSigBase,strJwe); CkStringBuilderW_Append(sbSigBase,L"\n"); CkStringBuilderW_Append(sbSigBase,L"\"@method\": POST\n"); // This is the path part of the URL without query params... CkStringBuilderW_Append(sbSigBase,L"\"@path\": "); CkStringBuilderW_Append(sbSigBase,L"/verifysignature"); CkStringBuilderW_Append(sbSigBase,L"\n"); // The is the domain, such as "api.ebay.com" w/ port if the port is something unusual. // In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis) // Normally, I think it would just be "api.ebay.com" instead of "localhost:8080". CkStringBuilderW_Append(sbSigBase,L"\"@authority\": "); CkStringBuilderW_Append(sbSigBase,L"localhost:8080"); CkStringBuilderW_Append(sbSigBase,L"\n"); CkStringBuilderW_Append(sbSigBase,L"\"@signature-params\": "); sbSigInput = CkStringBuilderW_Create(); CkStringBuilderW_Append(sbSigInput,L"(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")"); CkStringBuilderW_Append(sbSigInput,L";created="); dt = CkDateTimeW_Create(); CkDateTimeW_SetFromCurrentSystemTime(dt); unixTimeNow = CkDateTimeW_getAsUnixTimeStr(dt,FALSE); CkStringBuilderW_Append(sbSigInput,unixTimeNow); CkStringBuilderW_AppendSb(sbSigBase,sbSigInput); // ------------------------------------------------- // Sign the signature base string using the Ed25519 private key bdPrivKey = CkBinDataW_Create(); CkBinDataW_AppendEncoded(bdPrivKey,strPrivateKey,L"base64"); privKey = CkPrivateKeyW_Create(); success = CkPrivateKeyW_LoadAnyFormat(privKey,bdPrivKey,L""); if (success == FALSE) { wprintf(L"%s\n",CkPrivateKeyW_lastErrorText(privKey)); CkStringBuilderW_Dispose(sbBody); CkStringBuilderW_Dispose(sbSigBase); CkStringBuilderW_Dispose(sbSigInput); CkDateTimeW_Dispose(dt); CkBinDataW_Dispose(bdPrivKey); CkPrivateKeyW_Dispose(privKey); return; } bdToBeSigned = CkBinDataW_Create(); CkBinDataW_AppendSb(bdToBeSigned,sbSigBase,L"utf-8"); eddsa = CkEdDSAW_Create(); sigBase64 = CkEdDSAW_signBdENC(eddsa,bdToBeSigned,L"base64",privKey); if (CkEdDSAW_getLastMethodSuccess(eddsa) == FALSE) { wprintf(L"%s\n",CkEdDSAW_lastErrorText(eddsa)); CkStringBuilderW_Dispose(sbBody); CkStringBuilderW_Dispose(sbSigBase); CkStringBuilderW_Dispose(sbSigInput); CkDateTimeW_Dispose(dt); CkBinDataW_Dispose(bdPrivKey); CkPrivateKeyW_Dispose(privKey); CkBinDataW_Dispose(bdToBeSigned); CkEdDSAW_Dispose(eddsa); return; } wprintf(L"sigBase64:\n"); wprintf(L"%s\n",sigBase64); // ---------------------------------------------------------- // Send the JSON POST http = CkHttpW_Create(); CkHttpW_SetRequestHeader(http,L"x-ebay-signature-key",strJwe); sbContentDigestHdr = CkStringBuilderW_Create(); CkStringBuilderW_Append(sbContentDigestHdr,L"sha-256=:"); CkStringBuilderW_Append(sbContentDigestHdr,CkStringBuilderW_getHash(sbBody,L"sha256",L"base64",L"utf-8")); CkStringBuilderW_Append(sbContentDigestHdr,L":"); CkHttpW_SetRequestHeader(http,L"Content-Digest",CkStringBuilderW_getAsString(sbContentDigestHdr)); sbSigHdr = CkStringBuilderW_Create(); CkStringBuilderW_Append(sbSigHdr,L"sig1=:"); CkStringBuilderW_Append(sbSigHdr,sigBase64); CkStringBuilderW_Append(sbSigHdr,L":"); CkHttpW_SetRequestHeader(http,L"Signature",CkStringBuilderW_getAsString(sbSigHdr)); CkStringBuilderW_Prepend(sbSigInput,L"sig1="); CkHttpW_SetRequestHeader(http,L"Signature-Input",CkStringBuilderW_getAsString(sbSigInput)); // Add this header to make eBay actually check the signature. CkHttpW_SetRequestHeader(http,L"x-ebay-enforce-signature",L"true"); // Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header. CkHttpW_putAuthToken(http,L"your_oauth2_access_token"); // The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature" // Normally, you'll send your POST to some api.ebay.com endpoint. url = L"http://localhost:8080/verifysignature"; resp = CkHttpW_PostJson2(http,L"http://localhost:8080/verifysignature",L"application/json",CkStringBuilderW_getAsString(sbBody)); if (CkHttpW_getLastMethodSuccess(http) == FALSE) { wprintf(L"%s\n",CkHttpW_lastErrorText(http)); CkStringBuilderW_Dispose(sbBody); CkStringBuilderW_Dispose(sbSigBase); CkStringBuilderW_Dispose(sbSigInput); CkDateTimeW_Dispose(dt); CkBinDataW_Dispose(bdPrivKey); CkPrivateKeyW_Dispose(privKey); CkBinDataW_Dispose(bdToBeSigned); CkEdDSAW_Dispose(eddsa); CkHttpW_Dispose(http); CkStringBuilderW_Dispose(sbContentDigestHdr); CkStringBuilderW_Dispose(sbSigHdr); return; } wprintf(L"Response status code: %d\n",CkHttpResponseW_getStatusCode(resp)); wprintf(L"Response body:\n"); wprintf(L"%s\n",CkHttpResponseW_bodyStr(resp)); CkHttpResponseW_Dispose(resp); CkStringBuilderW_Dispose(sbBody); CkStringBuilderW_Dispose(sbSigBase); CkStringBuilderW_Dispose(sbSigInput); CkDateTimeW_Dispose(dt); CkBinDataW_Dispose(bdPrivKey); CkPrivateKeyW_Dispose(privKey); CkBinDataW_Dispose(bdToBeSigned); CkEdDSAW_Dispose(eddsa); CkHttpW_Dispose(http); CkStringBuilderW_Dispose(sbContentDigestHdr); CkStringBuilderW_Dispose(sbSigHdr); } |
© 2000-2024 Chilkat Software, Inc. All Rights Reserved.