Authentication签名认证

# bash + openssl
sign() { # secretKey METHOD path merchantCode timestamp requestId body
  local hash; hash=$(printf '%s' "$7" | openssl dgst -sha256 | awk '{print $NF}')
  printf '%s\n%s\n%s\n%s\n%s\n%s' "$2" "$3" "$4" "$5" "$6" "$hash" \
    | openssl dgst -sha256 -hmac "$1" | awk '{print $NF}'
}

import hashlib, hmac

def sign(secret_key, method, path, merchant_code, timestamp, request_id, raw_body: bytes) -> str:
    body_hash = hashlib.sha256(raw_body).hexdigest()
    s = "\n".join([method, path, merchant_code, timestamp, request_id, body_hash])
    return hmac.new(secret_key.encode(), s.encode(), hashlib.sha256).hexdigest()

# verify: hmac.compare_digest(sign(...), received_signature)

const crypto = require('crypto');

function sign(secretKey, method, path, merchantCode, timestamp, requestId, rawBody) {
  const bodyHash = crypto.createHash('sha256').update(rawBody).digest('hex');
  const s = [method, path, merchantCode, timestamp, requestId, bodyHash].join('\n');
  return crypto.createHmac('sha256', secretKey).update(s).digest('hex');
}

// verify: crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received)) (equal lengths first)

func Sign(secretKey, method, path, merchantCode, timestamp, requestID string, rawBody []byte) string {
	bodyHash := sha256.Sum256(rawBody)
	s := strings.Join([]string{method, path, merchantCode, timestamp, requestID, hex.EncodeToString(bodyHash[:])}, "\n")
	mac := hmac.New(sha256.New, []byte(secretKey))
	mac.Write([]byte(s))
	return hex.EncodeToString(mac.Sum(nil))
}

// verify: hmac.Equal([]byte(Sign(...)), []byte(received))

static String sign(String secretKey, String method, String path, String merchantCode,
                   String timestamp, String requestId, byte[] rawBody) throws Exception {
    String bodyHash = HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(rawBody));
    String s = String.join("\n", method, path, merchantCode, timestamp, requestId, bodyHash);
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    return HexFormat.of().formatHex(mac.doFinal(s.getBytes(StandardCharsets.UTF_8))); // Java 17+
}

// verify: MessageDigest.isEqual(expected.getBytes(), received.getBytes())

function sign(string $secretKey, string $method, string $path, string $merchantCode,
              string $timestamp, string $requestId, string $rawBody): string {
    $s = implode("\n", [$method, $path, $merchantCode, $timestamp, $requestId, hash('sha256', $rawBody)]);
    return hash_hmac('sha256', $s, $secretKey);
}

// verify: hash_equals(sign(...), $receivedSignature)

static string Sign(string secretKey, string method, string path, string merchantCode,
                   string timestamp, string requestId, byte[] rawBody)
{
    var bodyHash = Convert.ToHexString(SHA256.HashData(rawBody)).ToLowerInvariant();
    var s = string.Join("\n", method, path, merchantCode, timestamp, requestId, bodyHash);
    using var mac = new HMACSHA256(Encoding.UTF8.GetBytes(secretKey));
    return Convert.ToHexString(mac.ComputeHash(Encoding.UTF8.GetBytes(s))).ToLowerInvariant();
}

// verify: CryptographicOperations.FixedTimeEquals(expectedBytes, receivedBytes)

require 'openssl'

def sign(secret_key, method, path, merchant_code, timestamp, request_id, raw_body)
  body_hash = OpenSSL::Digest::SHA256.hexdigest(raw_body)
  s = [method, path, merchant_code, timestamp, request_id, body_hash].join("\n")
  OpenSSL::HMAC.hexdigest('SHA256', secret_key, s)
end