class AlexaWebService::Verify
Public Class Methods
new(request_env, request_body)
click to toggle source
# File lib/alexa_web_service/verify.rb, line 4 def initialize(request_env, request_body) @request_body = request_body @timestamp = JSON.parse(request_body)["request"]["timestamp"] @url = request_env["HTTP_SIGNATURECERTCHAINURL"] @signature = request_env["HTTP_SIGNATURE"] @digest = OpenSSL::Digest::SHA1.new end
Public Instance Methods
check_signature(certificate)
click to toggle source
# File lib/alexa_web_service/verify.rb, line 37 def check_signature(certificate) certificate.public_key.verify(@digest, Base64.decode64(@signature), @request_body) rescue false end
get_certificate()
click to toggle source
# File lib/alexa_web_service/verify.rb, line 27 def get_certificate begin OpenSSL::X509::Certificate.new HTTParty.get(@url) rescue TypeError "Bad Request" rescue OpenSSL::SSL::SSLError "Bad Request" end end
valid_address?()
click to toggle source
# File lib/alexa_web_service/verify.rb, line 12 def valid_address? valid_address = /^https:\/\/s3.amazonaws.com(:443)?\/echo.api\/.*?$/ @url == @url.match(valid_address)[0] rescue false end
valid_certificate?(certificate)
click to toggle source
# File lib/alexa_web_service/verify.rb, line 21 def valid_certificate?(certificate) certificate.subject.to_a.last.include?("echo-api.amazon.com") && Time.now.utc > certificate.not_before && Time.now.utc < certificate.not_after end
valid_timestamp?()
click to toggle source
# File lib/alexa_web_service/verify.rb, line 17 def valid_timestamp? Time.now < DateTime.parse(@timestamp).to_time + 150 rescue false end
verify_request()
click to toggle source
# File lib/alexa_web_service/verify.rb, line 41 def verify_request if valid_address? && valid_timestamp? @certificate = get_certificate else "Bad Request" end if valid_certificate?(@certificate) @verify = check_signature(@certificate) else "Invalid Certificate" end if @verify "OK" else "Invalid Signature" end end