PayNL.RequestSigning 2.0.0

Request Signing

This package adds functionality to sign & verify requests sent by the Pay. platform.

Usage

The RequestSigningService simplifies both signing and verifying requests, avoiding the need for manual class instantiation.

The constructor function of this service requires an array of SingingMethods that you wish to support. Each signing method has different needs and functionality, and which one(s) you opt to support falls under your discretion.

By providing the service with the array of these chosen methods, the service can handle the configuration and functionality. This decouples the setup process from your main application logic, allowing a more streamlined integration.

Signing

The below code snippet shows the basis of singing a request using this package:

using PayRequestSigningSdk;
 
// Generate
var signingService = new RequestSigningService(new List<IRequestSigningMethod>()
{
    new HmacSignature(new SignatureKeyRepository() ),
});

var request = new HttpRequestMessage(new HttpMethod("GET"), "http://localhost:5160/WeatherForecast");

var signed = signingService.Sign(request, "key", "sha512", "HMAC");
var http = new HttpClient();
var response = await http.SendAsync(signed);
Console.WriteLine($"Response: {response.Content.ReadAsStringAsync().Result}");
Console.WriteLine($"Signature: {signed.Headers.GetValues(IRequestSigningMethod.SignatureHeader).First()}");

// Verify
var verified = await signingService.VerifyAndDecodeAsync(signed);
Console.WriteLine($"Verify result: {JsonSerializer.Serialize(verified)}");

Exception handling

The request signing service and the underlying signing / verifying methods may throw exceptions when unexpected values are encountered, these are:

• SignatureKeyNotFound, this exception must be thrown when the implementation of the ISignatureKeyRepository can not find the key based on the provided id;
• UnknownSigningMethodException, this exception will be thrown by the singing / verifying methods when they are requested to sign / verify a request with an algorithm they do not support;
• UnsupportedHashingAlgorithmException, this exception will be thrown by the RequestSigningService when it is requested to sign / verify a request with a method it doesn't support.
• BodyDecodeException, this exception will be thrown if the body of the HttpMessage passed to the 'VerifyAndDecodeAsync' method is not in the expected format, if request is not GET.
• QueryUrlDecodeException, this exception will be thrown if the query string of the HttpMessage passed to the 'VerifyAndDecodeAsync' method is not in the expected format, if request is GET.
• InvalidSignatureException, this exception will be thrown if the process succeedes, but the resulting signature does not match the one provided by the request.

Supported Signing / Verifying methods

HMAC

The HmacSignature class enables the signing and verification of requests made with HMAC signatures. To utilize this class's method, a single argument is required for its constructor. This argument is of type IHmacSignatureKeyRepository.