![]() |
Chilkat HOME Android™ AutoIt C C# C++ Chilkat2-Python CkPython Classic ASP DataFlex Delphi DLL Go Java Node.js Objective-C PHP Extension Perl PowerBuilder PowerShell PureBasic Ruby SQL Server Swift Tcl Unicode C Unicode C++ VB.NET VBScript Visual Basic 6.0 Visual FoxPro Xojo Plugin
(VBScript) Verify Signature of Alexa Custom Skill RequestThis example verifies the signature of an Alexa Custom Skill Request. Note: This example requires Chilkat v11.0.0 or greater.
Dim fso, outFile Set fso = CreateObject("Scripting.FileSystemObject") 'Create a Unicode (utf-16) output text file. Set outFile = fso.CreateTextFile("output.txt", True, True) success = 0 ' This example assumes you have a web service that will receive requests from Alexa. ' A sample request sent by Alexa will look like the following: ' Connection: Keep-Alive ' Content-Length: 2583 ' Content-Type: application/json; charset=utf-8 ' Accept: application/json ' Accept-Charset: utf-8 ' Host: your.web.server.com ' User-Agent: Apache-HttpClient/4.5.x (Java/1.8.0_172) ' Signature: dSUmPwxc9...aKAf8mpEXg== ' SignatureCertChainUrl: https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem ' ' {"version":"1.0","session":{"new":true,"sessionId":"amzn1.echo-api.session.433 ... }} ' First, assume we've written code to get the 3 pieces of data we need: signature = "dSUmPwxc9...aKAf8mpEXg==" certChainUrl = "https://s3.amazonaws.com/echo.api/echo-api-cert-6-ats.pem" jsonBody = "{""version"":""1.0"",""session"":{""new"":true,""sessionId"":""amzn1.echo-api.session.433 ... }}" ' To validate the signature, we do the following: ' First, download the PEM-encoded X.509 certificate chain that Alexa used to sign the message set http = CreateObject("Chilkat.Http") set sbPem = CreateObject("Chilkat.StringBuilder") success = http.QuickGetSb(certChainUrl,sbPem) If (success = 0) Then outFile.WriteLine(http.LastErrorText) WScript.Quit End If set pem = CreateObject("Chilkat.Pem") success = pem.LoadPem(sbPem.GetAsString(),"passwordNotUsed") If (success = 0) Then outFile.WriteLine(pem.LastErrorText) WScript.Quit End If ' The 1st certificate should be the signing certificate. ' cert is a Chilkat.Cert Set cert = pem.GetCert(0) If (pem.LastMethodSuccess = 0) Then outFile.WriteLine(pem.LastErrorText) WScript.Quit End If ' Get the public key from the cert. ' pubKey is a Chilkat.PublicKey Set pubKey = cert.ExportPublicKey() If (cert.LastMethodSuccess = 0) Then outFile.WriteLine(cert.LastErrorText) WScript.Quit End If ' Use the public key extracted from the signing certificate to decrypt the encrypted signature to produce the asserted hash value. set rsa = CreateObject("Chilkat.Rsa") success = rsa.UsePublicKey(pubKey) If (success = 0) Then outFile.WriteLine(cert.LastErrorText) WScript.Quit End If ' RSA "decrypt" the signature. ' (Amazon's documentation is confusing, because we're simply verifiying the signature against the SHA-1 hash ' of the request body. This happens in a single call to VerifyStringENC...) rsa.EncodingMode = "base64" bVerified = rsa.VerifyStringENC(jsonBody,"sha1",signature) If (bVerified = 1) Then outFile.WriteLine("The signature is verified against the JSON body of the request. Yay!") Else outFile.WriteLine("Sorry, not verified. Crud!") End If outFile.Close |
© 2000-2025 Chilkat Software, Inc. All Rights Reserved.