• Signature Generation Challenge
  • Path
  • Salt
• Iteration
  • Boolean Values
  • Arrays
• Full Example
• Usage in Signature header

#Signature Generation Challenge

The procedures to create the signature for using the SSOfy server can be summed up as follows:

1. Combine all parameters of "query" and "form" into a single associative array.
2. Sort recursively by keys.
3. Iterate recursively through keys and merge values into a single linear string with no delimiters.
4. Concat PATH + VALUES + SALT.
5. Hash the concatenated string using HMAC-SHA256 method.

Depending on the implementation, the recursive sort and value concatenation procedure may vary. Some programmers choose to do the recursive sort first before merging the results, while others may combine the two operations in a single iteration.

#Path

Path in the url starting with /.

For instance, the path for a URL like https://api.ssofy.com/v1/authenticated/verify is:

/v1/authenticated/verify

#Salt

Salt should be a random string between 6 and 32 characters in length.

#Iteration

Here is a step-by-step breakdown of a sort and merge process:

Assuming we have a json payload like this:

{
    "b": "Red",
    "a": {
        "c": "Blue",
        "a": "Yellow",
        "b": "Green"
    }
}

The sorted object should resemble the following:

{
    "a": {
        "a": "Yellow",
        "b": "Green",
        "c": "Blue"
    },
    "b": "Red"
}

And here are the merged values:

YellowGreenBlueRed

YellowGreenBlueRed

#Boolean Values

Boolean values should be transformed into either 1 (true) or 0 (false).

#Arrays

Simple arrays should be considered index-associated since the iteration is over the keys of the array.

Example:

["A", "B", "C"]

=>

{
    0: "A",
    1: "B",
    2: "C"
}

#Full Example

Given the following parameters:

Our signature can be produced as follows:

1. Combine all parameters of "query" and "form" into a single associative array.

{
    "mood": "happy",
    "dummy": true,
    "b": "Red",
    "a": {
        "c": "Blue",
        "a": "Yellow",
        "b": "Green"
    }
}

2. Sort recursively by keys.

{
    "a": {
        "a": "Yellow",
        "b": "Green",
        "c": "Blue"
    },
    "b": "Red",
    "dummy": true,
    "mood": "happy"
}

3. Iterate recursively through keys and merge values into a single linear string with no delimiters.

YellowGreenBlueRed1happy

4. Concat PATH + VALUES + SALT.

/v1/signature-testYellowGreenBlueRed1happytUPDqF

5. Hash the concatenated string using HMAC-SHA256 method.

49dfbcc23614133ad4823f8027cd3b583dcab0c811f2f844d84c2cf453987131

#Usage in Signature header

When including the signature in request or response headers, the format should be a base64 representation of a json object containing both hash and salt:

{
    "hash": "49dfbcc23614133ad4823f8027cd3b583dcab0c811f2f844d84c2cf453987131",
    "salt": "tUPDqF"
}

=>

Signature: ewogICAgImhhc2giOiAiNDlkZmJjYzIzNjE0MTMzYWQ0ODIzZjgwMjdjZDNiNTgzZGNhYjBjODExZjJmODQ0ZDg0YzJjZjQ1Mzk4NzEzMSIsCiAgICAic2FsdCI6ICJ0VVBEcUYiCn0=