Issues with skill endpoint validation

[mrtomnguyen]

have you tried to submit the skill? this is what Amazon sent me:

"The skill does not validate the signature for the incoming requests and is accepting requests with invalid signature specified."

[gaiterjones]

I have not published any skills yet. I will look into this problem.

[mrtomnguyen]

for testing, it works fine and i do see the .pem in the cache. but i notice after submission, I see another .pem but its 0 kb empty.

[gaiterjones]

I guess I will have to submit a skill to troubleshoot this further, not sure what is happening. The second pem must be generated through the checks they are doing...

[gaiterjones]

We are creating the pem from

md5($_SERVER['HTTP_SIGNATURECERTCHAINURL']);

There is no check if md5($_SERVER['HTTP_SIGNATURECERTCHAINURL']); is set, or has data, this would create an empty pem. Perhaps we need to validate md5($_SERVER['HTTP_SIGNATURECERTCHAINURL']) as well

[gaiterjones]

Try adding the following before the "Determine if we need to download a new Signature Certificate Chain from Amazon" comment in AlexaRequrst.php

// validate signature data key // if (!isset($_SERVER['HTTP_SIGNATURECERTCHAINURL'])) { throw new \Exception('HTTP_SIGNATURECERTCHAINURL key not present'); }

// validate signature data //
if (empty($_SERVER['HTTP_SIGNATURECERTCHAINURL'])) { throw new \Exception('HTTP_SIGNATURECERTCHAINURL data not present'); }

[gaiterjones]

Also, instead of throwing exceptions can you try simply exiting. The exception returns an alexa response which is more designed to provide friendly errors when something in the intent processing goes wrong, with these validation errors amazon probably does not expect us to respond with valid response json.

[gaiterjones]

I have made these changes and updated AlexaRequest.php if you can test if for me that would be cool!

[mrtomnguyen]

so my question is why would their check request returns 0kb .pem ? so you think it's failing because the existing 0kb .pem is cached and Amazon returns error? every user will have a unique .pem right?

[gaiterjones]

Like I said the code wasn't checking for valid HTTP_SIGNATURECERTCHAINURL data and would create the .pem even if no SIGNATURECERTCHAINURL data was present. We are now checking for valid SIGNATURECERTCHAINURL data before trying to create the pem file.

[mrtomnguyen]

ok ive added it. so what happens when this is true? throw new \Exception('HTTP_SIGNATURECERTCHAINURL data not present');

[mrtomnguyen]

I'm still seeing the 0kb .pem Certification still failing. Here's the message:

Issues with skill endpoint validation

The skill does not validate the signature for the incoming requests and is accepting requests with invalid signature specified. Please refer to the document that describes how to build your Alexa Skill as a web service (available via this link: https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/developing-an-alexa-skill-as-a-web-service) for tips and requirements about validating the requests (and their signatures) sent to your web service.

[mrtomnguyen]

im gonna try to change the endpoint to the original azurewebsites and maybe that will fix the certificate issues. i was using a redirected ssl for domain.

[mrtomnguyen]

maybe the tips here may help. he discussed "Validating the signature of Alexa requests"

http://www.macadamian.com/2016/03/24/creating-a-new-alexa-skill/

[gaiterjones]

Unforuately the info there is for node.js. Its difficult for me to troubleshoot this as I have not yet submitted an app for public use. all my alexa apps are private.

[mrtomnguyen]

i think i know whats going on. upon submission, amazon does a check of sending an invalid request with Empty PEM. this is why i keep seeing the 0kb .pem immediately after submission. if the skill accept the invalid request, it fails. so ive updated the code to check for empty, hope this fixes it. i've checked your code and everything else looks right. **i'ev just resubmitted it and no 0kb .pem so far.

            // validate signature data      
            if (empty($_SERVER['HTTP_SIGNATURECERTCHAINURL']) || 
                $_SERVER['HTTP_SIGNATURECERTCHAINURL']=='null' ||
                $_SERVER['HTTP_SIGNATURECERTCHAINURL']=='')
            {
                throw new \Exception('HTTP_SIGNATURECERTCHAINURL data not present');
            }

its discussed here. https://github.com/AreYouFreeBusy/AlexaSkillsKit.NET/issues/5

[gaiterjones]

This is what I thought, didnt think to check for a null value though. Cool, good work! Please let me know if your app passes the validation and I will update my code. The link you provided documents a method of testing the signature validation yourself so that will be very useful for tesing.

[gaiterjones]

Did you see the string 'null' when you were testing? To check for null usually you would use is_null() or ==null, in your code =='null' checks for a string containing the word 'null' and not a null value.

Did your skill submit?

[mrtomnguyen]

certification pending. but i just saw the 0kb pem so ive updated to this:

            // validate signature data      
            if (empty($_SERVER['HTTP_SIGNATURECERTCHAINURL']) || 
                $_SERVER['HTTP_SIGNATURECERTCHAINURL']==null ||
                is_null($_SERVER['HTTP_SIGNATURECERTCHAINURL']) ||
                $_SERVER['HTTP_SIGNATURECERTCHAINURL']=='')
            {
                throw new \Exception('HTTP_SIGNATURECERTCHAINURL data not present');
            }

[gaiterjones]

I have updated AjaxRequest.php on github, it will also now return the correct 400 bad request when validation fails, I have also included the curl command to test validation, you will see the command when you go to alexa.php?debug

On 8 May 2017 at 16:30, Tom Nguyen notifications@github.com wrote:

certification pending. but i just saw the 0kb pem so ive updated to this:

      // validate signature data      
      if (empty($_SERVER['HTTP_SIGNATURECERTCHAINURL']) ||
          $_SERVER['HTTP_SIGNATURECERTCHAINURL']==null ||
          is_null($_SERVER['HTTP_SIGNATURECERTCHAINURL']) ||
          $_SERVER['HTTP_SIGNATURECERTCHAINURL']=='')
      {
          throw new \Exception('HTTP_SIGNATURECERTCHAINURL data not present');
      }

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/gaiterjones/amazon-alexa-php-hello-world-example/issues/3#issuecomment-299883271, or mute the thread https://github.com/notifications/unsubscribe-auth/ADuo_ocMaly4BuhiSj8iHyJm1qpTImzkks5r3ycXgaJpZM4NR8gO .

[gaiterjones]

Can you send me the log files so I can see what amazon are sending in the header for the validation attempts?

[gaiterjones]

I have made another update as there was an error in the validation order

        // Validate proper format of Amazon provided certificate chain url
        //
        $this->validateKeychainUri($_SERVER['HTTP_SIGNATURECERTCHAINURL']);

this should come before the pem file is created. You need to also change this as it will most certainly be causing problems!

[mrtomnguyen]

for some reason, the 0kb request isnt in the cache. the issue is still there so ive updated to this latest codes. ill submit again.

[mrtomnguyen]

ok i haven't seen the 0kb pem yet this last submission. maybe this one works.

[gaiterjones]

I am pretty sure it will work this time.

[mrtomnguyen]

Failed endpoint validation. Not in office to check the pem yet. Not sure what the issue is now.

[gaiterjones]

Did you completely update your AlexaRequest.php file to the latest version?

[mrtomnguyen]

No. Just ValidateAlexaRequest because it wasn't working when I changed the functions before it. What's new in those?

[mrtomnguyen]

can you try to submit a skill? chance is high that you wont pass for other issues but at least you can test the Certificate issue.

the feedback was a bit different this time:

"The skill end-point is not accepting valid signed requests. Please make sure that your signature URL validation is correct and also, the skill end-point is not validating the signatures for incoming requests and is accepting requests with an invalid signature URL specified. Please refer to the following documentation on how to build your Alexa Skill as a web service and validate requests and signatures."

[mrtomnguyen]

emailed you. i've contacted them for more details. hopefully they'll respond soon.

[gaiterjones]

As of version 0.1.0 the security validation elements of the script pass Amazons audit and requirements for submitting and publishing a public Alexa Skill. Thanks to Mr Tom for helping iron out the bugs in the script.