Ft2 - Secure Endpoints Behind HTTPSignatureVerifier + Add Debug Config

[noce2cicd]

Purpose

• Adds an HTTPRequestSignatureVerifier class that checks whether the requests to the function has been signed by the cloud gateway

Does this introduce a breaking change?

[X] Yes
[ ] No

Pull Request Type

What kind of change does this Pull Request introduce?

[ ] Bugfix
[X] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
./mvnw clean package
./mvnw azure-functions:run

• Test the code

  By default the verification will not run if the environment name is set to local. To test, change the setting MATH_DOJO_ENV_NAME in src/main/azure/local.settings.json to non-production and fill the keyId and publicKey variables with the values found in environments/non-production.yml. This will only give a negative test as any local calling client (postman etc) will be unable to sign its request with the correct key.

To test in the cloud, try the following:

## Should fail with 401
curl --location --request POST 'https://user-account-service-ft2.azurewebsites.net/api/hello' \
--header 'Content-Type: application/json' \
--header 'Authorization: garbages' \
--header 'Content-Type: application/json' \
--data-raw '{
    "name": "Wot oot"
}'

## Should pass with 200
curl --location --request POST 'https://mathdojoio.cloud.tyk.io/user-account-service-np-test/api/hello' \
--header 'Content-Type: application/json' \
--header 'Content-Type: application/json' \
--data-raw '{
    "name": "Wot oot"
}'

What to Check

Verify that the following are valid

• ...

Other Information