scotthovestadt / gigya

Gigya JavaScript REST SDK
MIT License
37 stars 62 forks source link

Signature is calculated wrong when signing requests containing boolean parameters. #60

Open bmxpiku opened 2 years ago

bmxpiku commented 2 years ago

As an example https://help.sap.com/viewer/8b8d6fffe113457094a17701f63e3d6a/GIGYA/en-US/559574624b634e5a955e0f7eeba01c07.html resetPassword allows you to send a parameter:

sendEmail | Boolean | The default is true . When set to false Gigya does not send the password reset email to the user, instead, the passwordResetToken and the list of valid email addresses are returned in the response of this method (see passwordResetToken and emails fields in the method response below).

then when calculating signature here: https://github.com/scotthovestadt/gigya/blob/737f4d54336c10e199bf9476506b952dc0a9bb5e/lib/requestsSigners/CredentialsSigner.ts#L41 it fails as it loses the value of sendEmail

code snippet to reproduce behavior:

var strictUriEncode = require('strict-uri-encode')
var requestParams ={
   loginID: 'bmxpiku@example.com',
   sendEmail: false,
   apiKey: 'api_Key',
   format: 'json',
   userKey: 'user_key',
   timestamp: 1639676755638,
   nonce: 1125281701940
 }
var queryString = Object.keys(requestParams).sort().map(function (key) { return key + "=" + strictUriEncode((requestParams[key] || '').toString()); })
//outputs:
[
  'apiKey=api_key',
  'format=json',
  'loginID=bmxpiku%40example.com',
  'nonce=1125281701940',
  'sendEmail=',
  'timestamp=1639676755638',
  'userKey=user_key'
]

// because:
> strictUriEncode(false || '')
// returns:
''

In relation to #59 -> I'm creating an issue on GH only to add a comment in the codebase of why I pass secret in URL as per gigya documentation:

When making the API call over HTTPS, you may pass the secret parameter. In such cases, the timestamp , nonce and sig parameters are no longer required.