APISIX HMAC Authentication

global_auth: false
consumers:
- name: consumer1
  access_key: consumer1-key
  secret_key: 2bda943c-ba2b-11ec-ba07-00163e1250b5
- name: consumer2
  access_key: consumer2-key
  secret_key: c8c8e9ca-558e-4a2d-bb62-e700dcc40e35

allow:
- consumer1  # Only consumer1 is allowed access

allow:
- consumer2  # Only consumer2 is allowed access

package main

import (
  "crypto/hmac"
  "crypto/sha1"
  "crypto/sha256"
  "crypto/sha512"
  "encoding/base64"
  "fmt"
  "hash"
  "strings"
  "time"
)

// SignedHeader defines the structure of signed headers
type SignedHeader struct {
  Name  string
  Value string
}

func main() {
  // Configuration parameters
  keyID := "consumer1-key"                            // Key ID
  secretKey := "2bda943c-ba2b-11ec-ba07-00163e1250b5" // Secret key
  requestMethod := "POST"                             // HTTP method
  requestPath := "/foo"                               // Route URI
  algorithm := "hmac-sha256"                          // Algorithm
  validateRequestBody := false                        // Whether to validate the request body; set to true to add the Digest header

  // If signed_headers is configured, add them in order
  signedHeaders := []SignedHeader{
    //{Name: "x-custom-header-a", Value: "test1"},
    //{Name: "x-custom-header-b", Value: "test2"},
  }

  body := []byte("{}") // Request body

  // Get current GMT time
  gmtTime := time.Now().UTC().Format("Mon, 02 Jan 2006 15:04:05 GMT")

  // Dynamically construct the signing string (in order)
  signingStringBuilder := strings.Builder{}
  signingStringBuilder.WriteString(fmt.Sprintf("%s\n%s %s\ndate: %s\n",
    keyID,
    requestMethod,
    requestPath,
    gmtTime))

  // Add headers in the order specified in signedHeaders
  for _, header := range signedHeaders {
    signingStringBuilder.WriteString(fmt.Sprintf("%s: %s\n", header.Name, header.Value))
  }

  signingString := signingStringBuilder.String()

  // Generate signature
  signature, err := generateHmacSignature(secretKey, algorithm, signingString)
  if err != nil {
    fmt.Printf("Error generating signature: %v\n", err)
    return
  }

  // Dynamically build the content of the headers field
  headersField := "@request-target date"
  for _, header := range signedHeaders {
    headersField += " " + header.Name
  }

  // Construct request headers
  headers := map[string]string{
    "Date": gmtTime,
    "Authorization": fmt.Sprintf(`Signature keyId="%s",algorithm="%s",headers="%s",signature="%s"`,
      keyID,
      algorithm,
      headersField,
      signature,
    ),
  }

  // Add Digest header if request body validation is required
  if validateRequestBody {
    headers["Digest"] = calculateBodyDigest(body)
  }

  // Add signed request headers
  for _, header := range signedHeaders {
    formattedHeaderName := formatHeaderName(header.Name)
    headers[formattedHeaderName] = header.Value
  }

  // Print the signing string
  fmt.Printf("signingString: %s\n", signingString)
  // Print request headers
  fmt.Println("Headers:")
  for key, value := range headers {
    fmt.Printf("%s: %s\n", key, value)
  }
}

// generateHmacSignature generates an HMAC signature
func generateHmacSignature(secretKey, algorithm, message string) (string, error) {
  var mac hash.Hash

  switch algorithm {
  case "hmac-sha1":
    mac = hmac.New(sha1.New, []byte(secretKey))
  case "hmac-sha256":
    mac = hmac.New(sha256.New, []byte(secretKey))
  case "hmac-sha512":
    mac = hmac.New(sha512.New, []byte(secretKey))
  default:
    return "", fmt.Errorf("unsupported algorithm: %s", algorithm)
  }

  mac.Write([]byte(message))
  signature := mac.Sum(nil)
  return base64.StdEncoding.EncodeToString(signature), nil
}

// calculateBodyDigest calculates the digest of the request body
func calculateBodyDigest(body []byte) string {
  hash := sha256.Sum256(body)
  encodedDigest := base64.StdEncoding.EncodeToString(hash[:])
  return "SHA-256=" + encodedDigest
}

// formatHeaderName converts the header name to standard HTTP header format
func formatHeaderName(headerName string) string {
  parts := strings.Split(headerName, "-")
  for i, part := range parts {
    if len(part) > 0 {
      parts[i] = strings.ToUpper(part[:1]) + strings.ToLower(part[1:])
    }
  }
  return strings.Join(parts, "-")
}

global_auth: false
consumers:
- name: consumer1
  access_key: consumer1-key
  secret_key: 2bda943c-ba2b-11ec-ba07-00163e1250b5
- name: consumer2
  access_key: consumer2-key
  secret_key: c8c8e9ca-558e-4a2d-bb62-e700dcc40e35
signed_headers:  # Custom request headers to be included in the signature
- X-Custom-Header-A
- X-Custom-Header-B
validate_request_body: true  # Enable request body signature verification

global_auth: true  # Enable global authentication
consumers:
- name: consumer1
  access_key: consumer1-key
  secret_key: 2bda943c-ba2b-11ec-ba07-00163e1250b5
- name: consumer2
  access_key: consumer2-key
  secret_key: c8c8e9ca-558e-4a2d-bb62-e700dcc40e35