Verifying signatures ?

[christopheblin]

Is there a way to verify a signature in a delivery receipt in Java (excpet by manually implementing https://developer.nexmo.com/concepts/guides/signing-messages#validate-the-signature-on-incoming-messages) ?

[judy2k]

If you have access to a servlet request, you can use: https://github.com/Nexmo/nexmo-java/blob/master/src/main/java/com/nexmo/client/auth/RequestSigning.java#L127

[christopheblin]

@judy2k thanks for answering my concern

I do not have access to a servlet request, however I think I can take the code snippet and give a try

my main concern is that I use the POST-JSON webhook so I do not see how the signature will differ from one request to another (i.e I have no parameters in the URL and the body is not www-form-encoded thus request.getParameterMap() will give nothing)

also, the clean(String str) looks a little strange to me but I'll try some experiments

first, I still need Nexmo to activate the signatures in the webhook since I do not receive the "sig" value... I'll come back to this thread to share results !

[christopheblin]

I manage to get it working without a servlet context, yeah ! :)

I've implemented a NexmoSigner class which takes a secret signature key and then can sign any combination of parameters

here is the code (this is kotlin language)

class NexmoSigner(val secretSigKey: String) {

    fun sign(sortedParams: TreeMap<String, String>): String {
        //adapted from https://github.com/Nexmo/nexmo-java/blob/master/src/main/java/com/nexmo/client/auth/RequestSigning.java

        // walk this sorted list of parameters and construct a string
        val sb = StringBuilder()
        for ((name, value) in sortedParams) {
            if (name == RequestSigning.PARAM_SIGNATURE) continue
            sb.append("&").append(clean(name)).append("=").append(clean(value))
        }
        // append the secret key and calculate an md5 signature of the resultant string
        sb.append(secretSigKey)

        val md5 = MD5Util.calculateMd5(sb.toString()
        return md5
    }

    private fun clean(str: String?): String? {
        return str?.replace("[=&]".toRegex(), "_")
    }
}

Then, I can use it to check the signature of my SMS receipt with a simple

    protected fun verifyRequestSignature(req: NexmoDeliveryWebhookRequest): Boolean {
        val md5 = nexmoSigner.sign(TreeMap<String, String>().apply {
            put("status", req.status)
            put("messageId", req.messageId)
            put("sig", req.sig) //will be excluded automatically
            put("timestamp", req.timestamp)
            put("err-code", req.errCode)
            put("message-timestamp", req.messageTimestamp)
            put("msisdn", req.msisdn)
            put("network-code", req.networkCode)
            put("price", req.price)
            put("scts", req.scts)
            put("to", req.to)
            put("nonce", req.nonce)
        })

        // verify that the supplied signature matches generated one
        return md5 == req.sig
    }

Note that NexmoDeliveryWebhookRequest is declared as followed

//see https://developer.nexmo.com/messaging/sms/guides/delivery-receipts and https://developer.nexmo.com/api/sms#delivery-receipt
data class NexmoDeliveryWebhookRequest(
        val status: String = "",
        val messageId: String = "",
        val sig: String = "",
        val timestamp: String = "",
        @SerializedName("err-code") val errCode: String = "",
        @SerializedName("message-timestamp") val messageTimestamp: String = "",
        val msisdn: String = "",
        @SerializedName("network-code") val networkCode: String = "",
        val price: String = "",
        val scts: String = "",
        val to: String = "",
        val nonce: String = "" //!\ undocumented in the Nexmo guide and API doc !!!
)

The "big" trouble to me was to find the 'nonce' parameter

The code could surely be improved (especially if you have the possibility to deal with the raw JSON, you can dynamically "discover" all the properties instead of having to declare a class like I did)