Add Vipps MobilePay provider - #2
Merged
Merged
Conversation
Vipps uses the Azure API Management scheme rather than a plain body HMAC, so
the generic handlers could not express it: the signed string is
METHOD\nPATH_AND_QUERY\nDATE;HOST;CONTENT_HASH
which covers the method, path, host and a SHA-256 of the body, not the body
itself. The existing {timestamp}/{payload} format has nowhere to put any of
that.
Two details worth calling out:
Verification is two steps. Because the signature covers a *hash* of the body,
checking the signature alone would accept a swapped payload that still carries
a valid signature. x-ms-content-sha256 is checked against the received bytes
first, and there is a test for exactly that swap.
The signature is passed pipe-delimited rather than comma-delimited as the other
multi-part providers do, because x-ms-date is RFC1123 and contains a comma of
its own ("Thu, 30 Mar 2023 08:38:32 GMT").
Host and path come from the required url option rather than the inbound Host
header, following square and hubspot, so a proxy rewriting Host cannot break
verification.
17 tests, covering the tampered-body swap, a mismatched content hash, stale and
unparseable dates, wrong host, wrong path, query strings, custom methods and
secret rotation. Full suite 111 passing, build clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vipps uses the Azure API Management signature scheme, which the generic HMAC handlers cannot express: the signed string is
METHOD\nPATH_AND_QUERY\nDATE;HOST;CONTENT_HASH, covering method, path, host and a SHA-256 of the body rather than the body itself.Two things worth a look in review:
x-ms-content-sha256is verified against the received bytes first, and there's a test for that swap specifically.<sig>|t=<date>|c=<hash>) instead of the comma-delimited convention the other multi-part providers use, becausex-ms-dateis RFC1123 and contains its own comma.Host and path are taken from the required
urloption rather than the inboundHostheader, followingsquareandhubspot.17 new tests; full suite 111 passing, build clean.
🤖 Generated with Claude Code
https://claude.ai/code/session_01JWFR6tkxmzVJGhNvwQ6rNu