lib/messagebird/request_validator.rb
##
# This method validates provided request signature, which is a JWT token.
# This JWT is signed with a MessageBird account unique secret key, ensuring the request is from MessageBird and a specific account.
# The JWT contains the following claims:
#      *   "url_hash" - the raw URL hashed with SHA256 ensuring the URL wasn't altered.
#      *    "payload_hash" - the raw payload hashed with SHA256 ensuring the payload wasn't altered.
#      *    "jti" - a unique token ID to implement an optional non-replay check (NOT validated by default).
#      *    "nbf" - the not before timestamp.
#      *    "exp" - the expiration timestamp is ensuring that a request isn't captured and used at a later time.
#      *    "iss" - the issuer name, always MessageBird.
# @param [String] signature the actual signature taken from request header "MessageBird-Signature-JWT".
# @param [String] url the raw url including the protocol, hostname and query string, e.g. "https://example.com/?example=42".
# @param [Array] request_body the raw request body.
# @return [Array] raw signature payload
# @raise [ValidationError] if signature is invalid
# @see https://developers.messagebird.com/docs/verify-http-requests
This method validates provided request signature, which is a JWT token.
This JWT is signed with a MessageBird account unique secret key, ensuring the request is from MessageBird and a specific account.
The JWT contains the following claims:
"url_hash" - the raw URL hashed with SHA256 ensuring the URL wasn't altered.
"payload_hash" - the raw payload hashed with SHA256 ensuring the payload wasn't altered.
"jti" - a unique token ID to implement an optional non-replay check (NOT validated by default).
"nbf" - the not before timestamp.
"exp" - the expiration timestamp is ensuring that a request isn't captured and used at a later time.
"iss" - the issuer name, always MessageBird.
This method validates provided request signature which is a JWT token . This JWT is signed with a MessageBird account unique secret key ensuring the request is from MessageBird and a specific account . The JWT contains the following claims : " url_hash " - the raw URL hashed with SHA256 ensuring the URL wasn ' t altered . " payload_hash " - the raw payload hashed with SHA256 ensuring the payload wasn ' t altered . " jti " - a unique token ID to implement an optional non - replay check ( NOT validated by default ) . " nbf " - the not before timestamp . " exp " - the expiration timestamp is ensuring that a request isn ' t captured and used at a later time . " iss " - the issuer name always MessageBird .
def validate_signature(signature, url, request_body)
      raise ValidationError, 'Signature can not be empty' if signature.to_s.empty?
      raise ValidationError, 'URL can not be empty' if !@skip_url_validation && url.to_s.empty?
      claims = decode_signature signature
      validate_url(url, claims['url_hash']) unless @skip_url_validation
      validate_payload(request_body, claims['payload_hash'])
      claims
    end
def validate_signature ( signature , url , request_body ) raise ValidationError , 'Signature can not be empty' if signature . to_s . empty? raise ValidationError , 'URL can not be empty' if ! @skip_url_validation && url . to_s . empty? claims = decode_signature signature validate_url ( url , claims [ 'url_hash' ] ) unless @skip_url_validation validate_payload ( request_body , claims [ 'payload_hash' ] ) claims end
This method validates provided request signature, which is a JWT token.
This method validates provided request signature which is a JWT token .
raw signature payload
raw signature payload
Array
[ValidationError] if signature is invalid
[ ValidationError ] if signature is invalid
signature
<not_specific>
url
<not_specific>
request_body
<not_specific>
<not_specific>
request_body the raw request body.
request_body the raw request body .
see
None