Sang.AspNetCore.SignAuthorization 1.1.0

SignAuthorization

A simple API URL signature verification middleware to validate requests through straightforward URL parameters.

English | 简体中文

How It Works

1. Sort the token, timestamp, and nonce parameters in lexicographic order.
2. Concatenate the three parameters into a single string and encrypt it using SHA1.
3. Developers can then compare the obtained encrypted string with the signature.

Instructions

Step 1: Add the Package

Install-Package Sang.AspNetCore.SignAuthorization

or

dotnet add package Sang.AspNetCore.SignAuthorization

Step 2: Enable the Middleware

Enable this middleware before app.MapControllers();.

app.UseSignAuthorization(opt => {
    opt.sToken = "your-api-token";
});

Step 3: Use SignAuthorizeAttribute

Add SignAuthorizeAttribute where signing is required.

Example:

app.MapGet("/weatherforecast", () =>
{
    // your code
}).WithMetadata(new SignAuthorizeAttribute());

or:

[HttpGet]
[SignAuthorize]
public IEnumerable<WeatherForecast> Get()
{
    // your code
}

Settings

SignAuthorizationOptions

Examples

PHP Example

$sToken = "your-api-token";
$sReqTimeStamp = time();
$sReqNonce = getNonce();
$tmpArr = array($sToken, $sReqTimeStamp, $sReqNonce);
sort($tmpArr, SORT_STRING);
$sign = sha1(implode($tmpArr));
$url = "http://localhost:5177/weatherforecast?timestamp=$sReqTimeStamp&nonce=$sReqNonce&signature=$sign";
echo "$url\n";
echo file_get_contents($url);

function getNonce(){
    $str = '1234567890abcdefghijklmnopqrstuvwxyz';
    $t1='';
    for($i=0;$i<30;$i++){
        $j=rand(0,35);
        $t1 .= $str[$j];
    }
    return $t1;
}

.Net Example

var unixTimestamp = DateTimeOffset.Now.ToUnixTimeSeconds();
var sNonce = Guid.NewGuid().ToString();

ArrayList AL = new ArrayList();
AL.Add("your-api-token");
AL.Add(unixTimestamp.ToString());
AL.Add(sNonce);
AL.Sort(StringComparer.Ordinal);

var raw = string.Join("", AL.ToArray());
using System.Security.Cryptography.SHA1 sha1 = System.Security.Cryptography.SHA1.Create();
byte[] encry = sha1.ComputeHash(Encoding.UTF8.GetBytes(raw));
string sign = string.Join("", encry.Select(b => string.Format("{0:x2}", b)).ToArray()).ToLower();

var client = new HttpClient();
string jsoninfo = await client.GetStringAsync($"http://localhost:5177/weatherforecast?timestamp={unixTimestamp}&nonce={sNonce}&signature={sign}");

Use MakeSignAuthorization

Make sign authorization string.

var unixTimestamp = DateTimeOffset.Now.ToUnixTimeSeconds().ToString();
var sNonce = Guid.NewGuid().ToString("N");
var sToken = "your-api-token";
var sPath = "/weatherforecast";
var sExtra = "1"; // extra parameter: extra=1
string sign = MakeSignAuthorization.MakeSign(sToken, unixTimestamp, sNonce, sPath, sExtra);

Make sign URL.

var url = MakeSignAuthorization.MakeSignUrl("http://localhost:5177",  new SignAuthorizationOptions());