Updated to check against SHA-256 signature of request body (fixes #47)

[tejashah88]

This should address #47. I'm thinking this should warrant a major version as it behaves differently enough. @mreinstein any thoughts on this and this PR?

Here's a full list of the changes:

Features:

• Bumped the alexa-verifier dependency to 4.0.0
• Updated the request headers being read to check the hashed signature

Testing:

• Fixed the "fail invalid signature" test, as it was checking for an invalid certificate parameter instead
• Ditched hardcoded signatures in favor of dynamically generated signatures (similar to what alexa-verifier does)
• Cleaned up, made the tests a bit more uniform (consistent checks and naming) and added some comments

[mreinstein]

Great work!

[mreinstein]

My understanding is that both the sha-256 and the sha1 headers are still present in the Amazon response headers, and updating to this module doesn't involve any breaking changes, but maybe I'm missing something?

[tejashah88]

You are correct, they still do have both headers. I figured if Amazon wants to use SHA-256 over SHA-1, they'll drop the latter at some point, and that would be a big behaviour change by itself (hence the major version bump).

However I'm not strongly rooted in this idea and open to other ideas too.

[mreinstein]

I think semver is only referring to the impact of the module on a person's local codebase. In the case of someone importing alexa-verifier-middleware, I don't see any changes that would be breaking on the code side.

[mreinstein]

The reason why I'm bringing this up is the downside to bumping the major version is it results in fewer people updated. Bumping the minor number instead will result in more people adopting it quickly, which is nice for an API change that might someday break if/when Amazon removes the non-256 version of the signature header.

[tejashah88]

You bring up a good point about version adoption. I'll make the changes later today.

[mreinstein]

nice work!

[tejashah88]

Thanks! I'll do the release on NPM