• Signature Verification

#Signature Verification

When designing and building resource endpoints, it is critical to verify the signature linked in the request headers to ensure that the request is coming from SSOfy.

Most web applications handle this in the middleware.

use SSOfy\SignatureGenerator;
use SSOfy\SignatureVerifier;
...
$generator = new SignatureGenerator();
$validator = new SignatureValidator($generator);

/** 
 * @var boolean $ok 
 */
$ok = $validator->verifyBase64Signature(
    $url, // current route url started with http:// or https://
    $params, // array combination of form and query parameters
    $secret, // your application secret
    $signature // signature in headers
);