spring-hmac-rest-verify

Another spring HMAC authentication filter for RESTfull webservice example.

Support http method: GET, HEAD, POST, PUT, DELETE, support Content-Type: application/x-www-form-urlencoded, application/json

You can define the NONCE, ACCESS-KEY, AUTHORIZATION header as follow, also can define the server.scheme, server.host, server.port.

hmac-verify:
  header:
    nonce: nonce
    access-key: accesskey
    authorization: authorization
  server:
    scheme: http
    host: localhost
    port: 8080

Both client and server digest of the following string:

METHOD\n
SCHEME\n
HOST\n
PATH\n
QUERY\n
CONTENT-TYPE\n
PAYLOAD\n
NONCE

METHOD: http method, such as GET, POST
SCHEME: http or https
HOST: localhost or other domain name.
PATH: http uri
QUERY: http query string
CONTENT-TYPE: content-type, support application/x-www-form-urlencoded or application/json
PAYLOAD: form format or json format
NONCE: nonce

main code

See the package io.github.qyvlik.springhmacrestverify.modules.hmac.

CachingRequestFilter : read the payload from request, so you don't need sorting the form-data.
HmacSignature: build hmac signature from HttpServletRequestWrapper.
HmacVerifyHelper: verify the client signature

example

server side

HmacVerifyHelper: verify the client signature, you can consult it for you own server.
CredentialsProviderMapImpl: simple provider for access-key, secret-key.