search

IBMStreams / endpoint-monitor

Nginx reverse proxy sample application to Streams REST operators.
Apache License 2.0
2 stars 4 forks source link

The signature check must be clearely documented #54

Closed joergboe closed 4 years ago

ddebrunner commented 5 years ago

@Karsten12 Can you create a .md file describing how to configure and use the signature check for POST etc that can be linked from the main README.md

Karsten12 commented 5 years ago

@joergboe I created a .md file in #63 that describes in detail how the signature verification works. You likely know more about endpoint-monitor than I do, so if I made a mistake in my explanation, please let me know and I'll fix it asap.

joergboe commented 5 years ago

What I mean is a description from the user point of view.

Karsten12 commented 5 years ago

Ok, I will consult with Dan about this and if need be, update my PR. But just off the top of my head, I don't believe signature check is of concern to the user, so the user cannot enable/disable it, but I could be wrong

Edit: I was wrong, will fix PR

ddebrunner commented 5 years ago

@Karsten12 Please create doc files in the newly added docs folder.

ddebrunner commented 5 years ago

cf https://github.com/IBMStreams/endpoint-monitor/blob/master/README.md#4-define-https-certificates

ddebrunner commented 5 years ago

Done.

ddebrunner commented 5 years ago

Actually, still need an example on signing requests.

joergboe commented 4 years ago

https://github.com/IBMStreams/endpoint-monitor/blob/develop/docs/signature_auth.md

To Sign a request (file dat0.txt contains the request body):

curl -k --header 'Content-Type: application/json' --header "X-Signature: $(openssl dgst -sha1 -hex -hmac password dat0.txt | cut -d ' ' -f 2 )" --request POST --data @dat0.txt