Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signature is calculated wrong when signing requests containing boolean parameters. #60

Open
bmxpiku opened this issue Dec 16, 2021 · 0 comments

Comments

@bmxpiku
Copy link

bmxpiku commented Dec 16, 2021

As an example https://help.sap.com/viewer/8b8d6fffe113457094a17701f63e3d6a/GIGYA/en-US/559574624b634e5a955e0f7eeba01c07.html
resetPassword allows you to send a parameter:

sendEmail | Boolean | The default is true . When set to false Gigya does not send the password reset email to the user, instead, the passwordResetToken and the list of valid email addresses are returned in the response of this method (see passwordResetToken and emails fields in the method response below).

then when calculating signature here:

protected createRequestSignature(secret: string, uri: string, requestParams: RequestParams<any>) {

it fails as it loses the value of sendEmail

code snippet to reproduce behavior:

var strictUriEncode = require('strict-uri-encode')
var requestParams ={
   loginID: '[email protected]',
   sendEmail: false,
   apiKey: 'api_Key',
   format: 'json',
   userKey: 'user_key',
   timestamp: 1639676755638,
   nonce: 1125281701940
 }
var queryString = Object.keys(requestParams).sort().map(function (key) { return key + "=" + strictUriEncode((requestParams[key] || '').toString()); })
//outputs:
[
  'apiKey=api_key',
  'format=json',
  'loginID=bmxpiku%40example.com',
  'nonce=1125281701940',
  'sendEmail=',
  'timestamp=1639676755638',
  'userKey=user_key'
]

// because:
> strictUriEncode(false || '')
// returns:
''

In relation to #59 -> I'm creating an issue on GH only to add a comment in the codebase of why I pass secret in URL as per gigya documentation:

When making the API call over HTTPS, you may pass the secret parameter. In such cases, the timestamp , nonce and sig parameters are no longer required.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant