search

kevin-mitchell / alexa-app

Set of classes to make creating Amazon Alexa Skills Kit (ASK) applications easier with Laravel and Lumen
MIT License
97 stars 47 forks source link

Does not verify a certificate chain trust #4

Open jakubsuchy opened 8 years ago

jakubsuchy commented 8 years ago

According to: https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/developing-an-alexa-skill-as-a-web-service#verifying-the-signature-certificate-url

One of the requirements is to: "All certificates in the chain combine to create a chain of trust to a trusted root CA certificate"

It doesn't seem like the app is doing this piece of validation?

develpr commented 8 years ago

I'd be interested to know if anybody else has issues here. In all honestly I've gotten up to the point of clicking the "submit for certification", including using a valid SSL cert, and I've had no issues up to this point with this requirement.

When I originally implemented this I did my best to stick to, what I thought, was the required path for handling the security related requirements as they were laid out by Amazon in their docs, but I'd be interested to know if anybody else has any input on this?