Typeform 安全性 API 和 Django：未正确验证哈希

Question

我正在尝试将 Typeform 的安全性用于他们的 webhook。这涉及

1) Receiving the signed packets and extracting the signature
2) Getting the body of the requst
3) Creating a hash with a secret key on the payload
4) Matching the hash with the received signature

我的网络框架是 Django（基于Python）。我在这里遵循 TypeForm link 中的示例：https://developer.typeform.com/webhooks/secure-your-webhooks/。

对于我的生活，我无法弄清楚发生了什么。我在 Python 和 Ruby 中都试过了，但我无法得到正确的哈希值。我从 Python 调用了一个 Ruby 脚本来匹配输出，但它们是不同的并且都不起作用。有没有人有任何见识？我开始认为这可能与 Django 发送请求主体的方式有关。有人有意见吗？

Python 实施：

import os
import hashlib
import hmac
import base64
import json


class Typeform_Verify:
    # take the request body in and encrypt with string
    def create_hash(payload):
        # convert the secret string to bytes 
        file = open("/payload.txt", "w") 
        # write to a payload file for the ruby script to read later
        file.write(str(payload))
        # access the secret string
        secret = bytearray(os.environ['DT_TYPEFORM_STRING'], encoding="utf-8")
        file.close()
        # need to have the ruby version also write to a file
        # create a hash with payload as the thing 
        #   and the secret as the key`
        pre_encode = hmac.new(secret,
            msg=payload, digestmod=hashlib.sha256).digest()
        post_encode = base64.b64encode(pre_encode)
        return post_encode

    # another approach is to make a ruby script 
    #   that returns a value and call it from here
    def verify(request):
        file = open("/output.txt", "w")
        # check the incoming hash values
        received_hash = request.META["HTTP_TYPEFORM_SIGNATURE"] 
        # create the hash of the payload
        hash = Typeform_Verify.create_hash(request.body)
        # call ruby script on it
        os.system(f"ruby manager/ruby_version.rb {received_hash} &> /oops.txt") 
        # concatenate the strings together to make the hash
        encoded_hash = "sha256=" + hash.decode("utf-8")
        file.write(f"Secret string: {os.environ['DT_TYPEFORM_STRING']}\n")
        file.write(f"My hash    : {encoded_hash}\n")
        file.write(f"Their hash : {received_hash}\n")
        file.close()
        return received_hash == encoded_hash

Ruby 脚本（从 Python 调用）

require 'openssl'
require 'base64'
require 'rack'
def verify_signature(received_signature, payload_body, secret)
  hash = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), secret, payload_body)
  # the created signature
  actual_signature = 'sha256=' + Base64.strict_encode64(hash) 
  # write created signature to the file
  out_file = File.new("/output.txt", "a")
  out_file.write("Ruby output: ")
  out_file.write(actual_signature)
  out_file.close()
  return 500, "Signatures don't match!" unless Rack::Utils.secure_compare(actual_signature, received_signature)
end

# MAIN EXECUTION 
# get the hash from the python scriupt
received_hash = ARGV[0]
# read the content of the file into the f array 
    # note that this is the json payload from the python script
f = IO.readlines("/payload.txt")
# declare the secret string
secret = "SECRET"
# call the funtion with the recieved hash, file data, and key
result = verify_signature(received_hash, f[0], secret)

代码输出：

Typeform hash:   sha256=u/A/F6u3jnG9mr8KZH6j8/gO+Uny6YbSYFz7+oGmOik=
Python hash:     sha256=sq7Kl2qBwRrwgGJeND6my4UPli8rseuwaK+f/sl8dko=
Ruby output:     sha256=BzMxPZGmxgOMeJ236eAxSOXj85rEWI84t+6CtQBYliA=

Answer 1

已更新首先查看 this github article，因为您提到的那个可能是基于它的。

我们的想法是您的请求应该被签名。这是一个更基本的纯 ruby 示例，它应该说明它应该如何工作。

# test.rb
ENV['SECRET_TOKEN'] = 'foobar'
require 'openssl'
require 'base64'
require 'rack'

def stub_request(body)
  key = ENV['SECRET_TOKEN']
  digest = OpenSSL::Digest.new('sha256')
  hmac_signature = OpenSSL::HMAC.hexdigest(digest, key, body)
  { body: body, hmac_signature: hmac_signature }
end

def verify_signature(payload_body, request_signature)
  digest = OpenSSL::Digest.new('sha256')
  hmac = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), ENV['SECRET_TOKEN'], payload_body)
  if Rack::Utils.secure_compare(request_signature, hmac)
    puts "They match"
  else
    puts "They don't match"
  end
  puts "request_signature: #{request_signature}"
  puts "             hmac: #{hmac}"
  puts "             body: #{payload_body}"
end

request = stub_request(ARGV[0])
verify_signature(request[:body], request[:hmac_signature])

现在要测试这个，只需运行:

ruby test.rb 'this is some random body string'

这是相同代码的 Python 版本。但如果您的服务器还没有类似的东西，这很容易受到 Python 中的 timing attack vulnerability. There is probably a Python equivalent somewhere to mitigate this but I didn't do the research to find it. It shouldn't be hard to write something like the Ruby Rack version here 的攻击。

#test.py
import sys
import hashlib
import binascii
import hmac
import base64

KEY = 'foobar'

def stub_request(body):
    key = bytes(KEY, 'utf-8')
    body_bytes = bytes(body, 'utf-8')
    hmac_signature = hmac.new(key,
        msg=body_bytes, digestmod=hashlib.sha256).digest()
    return {'body': body, 'hmac_signature': hmac_signature}

def verify_signature(payload_body, request_signature):
    key = bytes(KEY, 'utf-8')
    hmac_sig = hmac.new(key, msg=bytes(payload_body,'utf-8'), digestmod=hashlib.sha256).digest()

    if hmac_sig == request_signature:
        print("They match")
    else  :
        print("They don't match")

    print(f"request_signature: {binascii.hexlify(request_signature)}")
    print(f"             hmac: {binascii.hexlify(hmac_sig)}")
    print(f"             body: {payload_body}")
    return request_signature

body = sys.argv[-1]
request = stub_request(body)
verify_signature(request['body'], request['hmac_signature'])

Answer 2

我终于搞清楚了。 Python 实施我工作得很好。问题在于我如何保存秘密字符串。显然，Python 中的环境变量不允许使用 $ 或 * 这样的字符。当我将我的秘密硬编码到代码中时，我的 Ruby 实现开始工作，这让我相信问题在于我如何保存秘密字符串。我向任何尝试进行此类身份验证的人推荐 Python 实现。干杯！

Typeform 安全性 API 和 Django：未正确验证哈希

Typeform Security API and Django: Not Verifiying Hash Correctly

django

ruby

hash

webhooks

typeform