API 鉴权
PRS 提供两种鉴权方式,验证 Token和验证用户签名,都是通过 HTTP header 进行。
通过验证 Token 鉴权
HTTP header 里加 Authorization:
Authorization: Bearer ${token}
token
: 用户授权之后获取到的 access token。
Example:
假设 DApp 经过授权之后,获取到对应的 token。
token | eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MzYsImp0aSI6IjhkNWNjYzFmLWRmYjEtNDZjMC04MDc2LWNkMGE1ZDVmNWQ5MSIsImRhdGEiOnsiYXV0aEFkZHJlc3MiOiIyMTQ1ZWZkZDA0ZjJiZmIyNjhmZjIxNDY0MjE4NDE4MTYzZWJkNjBkIn0sInByb3ZpZGVyIjoiZGFwcCIsImV4cCI6MTU1MTQ1NTEzNn0.-z9atlcBRsB5Z7M7joOMLvD5UaNhy-15hycLpV0XpUw |
调用获取指定签名文件 API 为:
curl -X GET https://${host}/api/v2/files/a23b19df1264d406ac81094af463d6fc03caafb997d8d8f64759340752dd21ad \
-H "Accept: application/json" \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MzYsImp0aSI6IjhkNWNjYzFmLWRmYjEtNDZjMC04MDc2LWNkMGE1ZDVmNWQ5MSIsImRhdGEiOnsiYXV0aEFkZHJlc3MiOiIyMTQ1ZWZkZDA0ZjJiZmIyNjhmZjIxNDY0MjE4NDE4MTYzZWJkNjBkIn0sInByb3ZpZGVyIjoiZGFwcCIsImV4cCI6MTU1MTQ1NTEzNn0.-z9atlcBRsB5Z7M7joOMLvD5UaNhy-15hycLpV0XpUw"
通过验证签名鉴权
HTTP header 里加 X-Po-Auth-Address、X-Po-Auth-Msghash、X-Po-Auth-Sig。
Key | Value |
---|---|
X-Po-Auth-Address | 当前用户的 Address |
X-Po-Auth-Msghash | 请求消息体的 hash 值 |
X-Po-Auth-Sig | 使用私钥对消息体 hash 进行椭圆加密值得到的数字签名 |
Example:
POST /api/v2/apps/${address}/authenticate
我们用换取 token 的接口来举例,假设 DApp 创建成功之后,获取到 DApp 的私钥以及地址。用户经过 Web 授权返回了 code。
address | 6b16c956d963e2c38e07d49af37b66a1de490a97 |
privateKey | 8f8aa65494a9880130842fcec4208ce9ae6667d38422c36e832564408bc1fad5 |
code | eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MTUsImp0aSI6Ijg5M2NiMjAwLTNiNTQtNDYzNC1hODNlLWU3ZmJmNzQ3YjVjNiIsImRhdGEiOnsidXNlckFkZHJlc3MiOiJjYjdiNzUxMDNjNzMzY2M1NzQzYTM5MGZhZjdiZGVkYzYxNzg2ZTI5IiwiYXBwQWRkcmVzcyI6IjZiMTZjOTU2ZDk2M2UyYzM4ZTA3ZDQ5YWYzN2I2NmExZGU0OTBhOTciLCJ0eXBlIjoicGhvbmUifSwicHJvdmlkZXIiOiJwcmVzc29uZSIsImV4cCI6MTU1MTQ1NTExNX0.KQeimVWpEnTs-8FyvDYh-mppG1_kMKiPGZOf8mY3pfA |
接下来我们来调用这个接口
- 根据
path
与payload
计算出 msghash。
path
: 是 Api 的路径,这里是 '/apps/${address}/authenticate'payload
: 是请求 body。
{
"payload":{
"code": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MTUsImp0aSI6Ijg5M2NiMjAwLTNiNTQtNDYzNC1hODNlLWU3ZmJmNzQ3YjVjNiIsImRhdGEiOnsidXNlckFkZHJlc3MiOiJjYjdiNzUxMDNjNzMzY2M1NzQzYTM5MGZhZjdiZGVkYzYxNzg2ZTI5IiwiYXBwQWRkcmVzcyI6IjZiMTZjOTU2ZDk2M2UyYzM4ZTA3ZDQ5YWYzN2I2NmExZGU0OTBhOTciLCJ0eXBlIjoicGhvbmUifSwicHJvdmlkZXIiOiJwcmVzc29uZSIsImV4cCI6MTU1MTQ1NTExNX0.KQeimVWpEnTs-8FyvDYh-mppG1_kMKiPGZOf8mY3pfA"
}
}
calcRequestHash(path, payload)
= 7b61f7ee90d333017e4fc822adf196030ef8ae457c6f8d7b2f6b8776a6a50c6e
- 使用私钥对 msghash 签名。
const { signature } = signByMsghash(hash, privateKey) => {
return signByMsghash(hash, privateKey);
};
signByMsghash(hash, privateKey)
= signByMsghash('7b61f7ee90d333017e4fc822adf196030ef8ae457c6f8d7b2f6b8776a6a50c6e', '8f8aa65494a9880130842fcec4208ce9ae6667d38422c36e832564408bc1fad5')
= 7a405ca5a2f8d925e70be5346b7b3974a8f9b172c755555ba149cca8cc9c737e6c3e7d35e17893ea5893fb0515d0c5019f3ddd5ce716e813506a4f146eeefd9a1
- 将 address、msghash、signature 添加到 HTTP header 中即可。
curl -X POST https://beta.press.one/api/v2/apps/6b16c956d963e2c38e07d49af37b66a1de490a97/authenticate \
-H "Content-Type: application/json" \
-H "X-Po-Auth-Address: 6b16c956d963e2c38e07d49af37b66a1de490a97" \
-H "X-Po-Auth-Msghash: 7b61f7ee90d333017e4fc822adf196030ef8ae457c6f8d7b2f6b8776a6a50c6e" \
-H "X-Po-Auth-Sig: 7a405ca5a2f8d925e70be5346b7b3974a8f9b172c755555ba149cca8cc9c737e6c3e7d35e17893ea5893fb0515d0c5019f3ddd5ce716e813506a4f146eeefd9a1" \
-d '{ "payload": { "code": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NTExOTU5MTUsImp0aSI6Ijg5M2NiMjAwLTNiNTQtNDYzNC1hODNlLWU3ZmJmNzQ3YjVjNiIsImRhdGEiOnsidXNlckFkZHJlc3MiOiJjYjdiNzUxMDNjNzMzY2M1NzQzYTM5MGZhZjdiZGVkYzYxNzg2ZTI5IiwiYXBwQWRkcmVzcyI6IjZiMTZjOTU2ZDk2M2UyYzM4ZTA3ZDQ5YWYzN2I2NmExZGU0OTBhOTciLCJ0eXBlIjoicGhvbmUifSwicHJvdmlkZXIiOiJwcmVzc29uZSIsImV4cCI6MTU1MTQ1NTExNX0.KQeimVWpEnTs-8FyvDYh-mppG1_kMKiPGZOf8mY3pfA" } }'
hash、加密算法的具体实现请参考数字签名。