Stateless auth for rest api

Query Authentication

All REST queries must be authenticated by signing the query parameters sorted in lower-case, alphabetical order using the private credential as the signing token. Signing should occur before URL encoding the query string.

In other words, you don't pass the shared secret component of the API key as part of the query, but instead use it to sign the query. Your queries end up looking like this:

GET /object?timestamp=1261496500&apiKey=Qwerty2010&signature=abcdef0123456789

The string being signed is "/object?apikey=Qwerty2010×tamp=1261496500" and the signature is the HMAC-SHA256 hash of that string using the private component of the API key.

The main objection to this approach is that the private API key devolves into a kind of password for static calls. For example, if the query were instead:

GET /object?apiKey=Qwerty2010

The signature would be the same every time you made that specific query. However, you are using SSL, right? Furthermore, adding in a timestamp makes each query differ. For extra security, you can make the timestamp a more formal date-time value with time zone information and disallow queries outside of the query range.

The real controversy is whether signing should occur before or after URL encoding values. There is no "right" answer. I lean towards signing before encoding because most programming tools make it easier on the server side to get the unencoded values versus the encoded values. I'm sure good arguments can be made the other way. What I really care about is this: let's pick one and stick with it.

Contexte :
Derniere version de rpaf et apache 2.4 (jessie)

La variable %h qui est utilisée dans les LogFormat de base n'est pas substituée par rpaf... il faut la remplacer par %a qui elle, est bien modifiée par rpaf

La commande eb d'amazon retourne toujours 0 même quand elle foire.. pas pratique pour repérer une erreur dans les script de CI..

Mes scripts bash commencent tous avec "set -e" pour sortir en erreur des qu'il y a un probleme

La commande eb me pose donc problème, j'ai fixé ça de cette mainère en attendant de trouver mieux :

eb blablabla 2>&1 | ( ! grep ERROR)

De cette manière, si dans le stdout ou dans le stderr on trouve 'ERROR', le grep va matcher et renvoyer 1 (dans une utilisation normale, grep retourne 0 si il match, mais avec le point d'exclamation, on inverse ce retour)

Ce qui aura pour effet de passer mon script en erreur !

Un tenkeyless ISO Azerty

TIL :

What is this date format? 2011-08-12T20:17:46.384

The T is just a literal to separate the date from the time, and the Z means "zero hour offset" also known as "Zulu time" (UTC). If your strings always have a "Z" you can use

perso je tends pour le rebase