You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2021/04/23 05:37:16 UTC
[GitHub] [apisix] riskgod opened a new issue #4117: { message: 'Invalid signature' }
riskgod opened a new issue #4117:
URL: https://github.com/apache/apisix/issues/4117
hey I add Date into the SIGNATURE, but it failed, please help a check. thank you.
```
curl http://127.0.0.1:9080/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d '
{
"username": "kelly",
"plugins": {
"hmac-auth": {
"access_key": "user-key-kelly",
"secret_key": "my-secret-key—kelly",
"clock_skew": 5,
"signed_headers": ["Date", "User-Agent", "x-custom-a"]
}
}
}'
```
```
const crypto = require('crypto');
const axios = require('axios').default;
const today = new Date();
const dataNow = today.toGMTString();
const live =
`GET
/health
user-key-kelly
${dataNow}
User-Agent:curl/7.29.0
x-custom-a:test
`;
const test_signature = crypto.createHmac('sha256', "my-secret-key—kelly").update(live).digest("base64");
const headers = {
"X-HMAC-SIGNATURE": test_signature,
"X-HMAC-ALGORITHM": "hmac-sha256",
"X-HMAC-ACCESS-KEY": "user-key-kelly",
"X-HMAC-SIGNED-HEADERS": "Date;User-Agent;x-custom-a",
"Date": dataNow,
"User-Agent": "curl/7.29.0",
"x-custom-a": "test"
}
const options = {
method: 'GET',
headers: headers,
url:"http://127.0.0.1:9080/health",
};
async function test() {
try {
const result = await axios(options);
console.log(result)
} catch (error) {
console.error(error.response.data)
}
}
test()
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou edited a comment on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
Firstsawyou edited a comment on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825420666
> ${dataNow}
> User-Agent:curl/7.29.0
> x-custom-a:test
The signature string here seems to be incorrect, we don't need a key in the signature header. You try it like this:
```
const live =
`GET
/health
user-key-kelly
Date:${dataNow}
User-Agent:curl/7.29.0
x-custom-a:test
`;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] riskgod commented on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
riskgod commented on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825422557
> > ${dataNow}
> > User-Agent:curl/7.29.0
> > x-custom-a:test
>
> The signature string here seems to be incorrect, we don't need a key in the signature header. You try it like this:
>
> ```
> const live =
> `GET
> /health
>
> user-key-kelly
> ${dataNow}
> curl/7.29.0
> test
> `;
> ```
still failed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825491372
In the lower part of the hmac-auth plugin, adjust the log level to warn and check the log output.
https://github.com/apache/apisix/blob/725e9879cdfba39b5a16e027f345ca26ee43c499/apisix/plugins/hmac-auth.lua#L296
https://github.com/apache/apisix/blob/725e9879cdfba39b5a16e027f345ca26ee43c499/apisix/plugins/hmac-auth.lua#L270-L273
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] riskgod closed issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
riskgod closed issue #4117:
URL: https://github.com/apache/apisix/issues/4117
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] riskgod commented on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
riskgod commented on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825507023
> In the lower part of the hmac-auth plugin, adjust the log level to warn and check the log output.
>
> https://github.com/apache/apisix/blob/725e9879cdfba39b5a16e027f345ca26ee43c499/apisix/plugins/hmac-auth.lua#L296
>
> https://github.com/apache/apisix/blob/725e9879cdfba39b5a16e027f345ca26ee43c499/apisix/plugins/hmac-auth.lua#L270-L273
hey after check with debug log, find the problem, thank you man,
##### This signing string is from apisix itself.
```
signing_string: POST
/checkAddress
user-key-tomi
Fri, 23 Apr 2021 08:36:32 GMT
Date:Fri, 23 Apr 2021 08:36:32 GMT
User-Agent:curl/7.29.0
x-custom-a:test
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825420666
> ${dataNow}
> User-Agent:curl/7.29.0
> x-custom-a:test
The signature string here seems to be incorrect, we don't need a key in the signature header. You try it like this:
```
const live =
`GET
/health
user-key-kelly
${dataNow}
curl/7.29.0
test
`;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] riskgod edited a comment on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
riskgod edited a comment on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825507023
> In the lower part of the hmac-auth plugin, adjust the log level to warn and check the log output.
>
> https://github.com/apache/apisix/blob/725e9879cdfba39b5a16e027f345ca26ee43c499/apisix/plugins/hmac-auth.lua#L296
>
> https://github.com/apache/apisix/blob/725e9879cdfba39b5a16e027f345ca26ee43c499/apisix/plugins/hmac-auth.lua#L270-L273
hey after check with debug log, find the problem, thank you man,
#### This signing string is from apisix itself.
```
signing_string: POST
/checkAddress
user-key-tomi
Fri, 23 Apr 2021 08:36:32 GMT
Date:Fri, 23 Apr 2021 08:36:32 GMT
User-Agent:curl/7.29.0
x-custom-a:test
```
Well, we need to update he signing string in our code
```
const today = new Date();
const dateNow = today.toGMTString();
console.log(dateNow)
const check_address =
`POST
/checkAddress
user-key-tomi
${dateNow}
Date:${dateNow}
User-Agent:curl/7.29.0
x-custom-a:test
`;
```
Now , it works!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] riskgod commented on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
riskgod commented on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825460444
> Try to set the value of `clock_skew` to a higher value?
still failed， after test 2 kind of valid, one is success without clock_skew, here is the test code
```
const crypto = require('crypto');
const axios = require('axios').default;
import qs from 'qs';
const today = new Date();
const dateNow = today.toGMTString();
const check_address =
`POST
/checkAddress
user-key-kelly
${dateNow}
User-Agent:curl/7.29.0
x-custom-a:test
`;
const live =
`GET
/health
user-key-kelly
${dateNow}
User-Agent:curl/7.29.0
x-custom-a:test
`;
const userWithdrawal =
`POST
/userWithdrawal
user-key-tomi
Mon, Tue, 19 Jan 2021 11:33:20 GMT
User-Agent:curl/7.29.0
x-custom-a:test
`;
const sign_string_tomi = crypto.createHmac('sha256', "my-secret-key—tomi").update(check_address).digest("base64");
const sign_string_kelly = crypto.createHmac('sha256', "my-secret-key—kelly").update(live).digest("base64");
console.log(sign_string_kelly)
async function testTomi() {
const bodyData = {"coin":"BTC", "address":"rpE6gE8jEN1trDwQwe47VmgDL5y6m3XX2n"};
const headers = {
"Content-Type": "application/json",
"X-HMAC-SIGNATURE": sign_string_tomi,
"X-HMAC-ALGORITHM": "hmac-sha256",
"X-HMAC-ACCESS-KEY": "user-key-tomi",
"Date": dateNow,
"X-HMAC-SIGNED-HEADERS": "Date;User-Agent;x-custom-a",
"User-Agent": "curl/7.29.0",
"x-custom-a": "test"
}
try {
const options = {
method: 'POST',
headers: headers,
data: qs.stringify(bodyData),
url: "http://127.0.0.1:9080/checkAddress"
};
const result = await axios(options);
console.log(result.data)
} catch (error) {
console.error(error.response.data)
}
}
async function testkelly() {
const headers = {
"X-HMAC-SIGNATURE": sign_string_kelly,
"X-HMAC-ALGORITHM": "hmac-sha256",
"X-HMAC-ACCESS-KEY": "user-key-kelly",
"Date": dateNow,
"X-HMAC-SIGNED-HEADERS": "User-Agent;x-custom-a",
"User-Agent": "curl/7.29.0",
"x-custom-a": "test"
}
try {
const options = {
method: 'GET',
headers: headers,
url: "http://127.0.0.1:9080/health"
};
const result = await axios(options);
console.log(result.data)
} catch (error) {
console.error(error.response.data)
}
}
// testkelly()
testTomi()
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #4117: { message: 'Invalid signature' } in hmac after add Date clock_skew
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #4117:
URL: https://github.com/apache/apisix/issues/4117#issuecomment-825428685
Try to set the value of `clock_skew` to a higher value?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org