class AlexaWebService::Verify

Public Class Methods

new(request_env, request_body) click to toggle source
# File lib/alexa_web_service/verify.rb, line 4
def initialize(request_env, request_body)
  @request_body = request_body
  @timestamp = JSON.parse(request_body)["request"]["timestamp"]
  @url = request_env["HTTP_SIGNATURECERTCHAINURL"]
  @signature = request_env["HTTP_SIGNATURE"]
  @digest = OpenSSL::Digest::SHA1.new
end

Public Instance Methods

check_signature(certificate) click to toggle source
# File lib/alexa_web_service/verify.rb, line 37
      def check_signature(certificate)
  certificate.public_key.verify(@digest, Base64.decode64(@signature), @request_body) rescue false
end
get_certificate() click to toggle source
# File lib/alexa_web_service/verify.rb, line 27
  def get_certificate
       begin
                OpenSSL::X509::Certificate.new HTTParty.get(@url)
        rescue TypeError
                "Bad Request"
        rescue OpenSSL::SSL::SSLError
                "Bad Request"
        end
end
valid_address?() click to toggle source
# File lib/alexa_web_service/verify.rb, line 12
def valid_address?
  valid_address = /^https:\/\/s3.amazonaws.com(:443)?\/echo.api\/.*?$/
  @url == @url.match(valid_address)[0] rescue false
end
valid_certificate?(certificate) click to toggle source
# File lib/alexa_web_service/verify.rb, line 21
def valid_certificate?(certificate)
  certificate.subject.to_a.last.include?("echo-api.amazon.com") && 
  Time.now.utc > certificate.not_before && 
  Time.now.utc < certificate.not_after
end
valid_timestamp?() click to toggle source
# File lib/alexa_web_service/verify.rb, line 17
def valid_timestamp?
  Time.now < DateTime.parse(@timestamp).to_time + 150 rescue false
end
verify_request() click to toggle source
# File lib/alexa_web_service/verify.rb, line 41
def verify_request

        if valid_address? && valid_timestamp?
           @certificate = get_certificate
        else
           "Bad Request"
        end

        if valid_certificate?(@certificate)
           @verify = check_signature(@certificate)
        else
           "Invalid Certificate"
        end

        if @verify
           "OK"
        else
           "Invalid Signature"
        end
      end