{"id":19107170,"url":"https://github.com/govtechsg/apex-signature-validator","last_synced_at":"2025-04-30T18:12:28.175Z","repository":{"id":29597506,"uuid":"120737014","full_name":"GovTechSG/apex-signature-validator","owner":"GovTechSG","description":"HTTP Signature validator and test client for APEX ","archived":false,"fork":false,"pushed_at":"2024-08-07T06:02:43.000Z","size":6113,"stargazers_count":2,"open_issues_count":52,"forks_count":2,"subscribers_count":21,"default_branch":"master","last_synced_at":"2025-04-30T18:12:21.336Z","etag":null,"topics":["angularjs","angularjs1","hmac-sha256","http-signature","jose","rsa-signature","webpack"],"latest_commit_sha":null,"homepage":"https://govtechsg.github.io/apex-signature-validator/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GovTechSG.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-02-08T09:03:13.000Z","updated_at":"2019-10-15T04:51:11.000Z","dependencies_parsed_at":"2024-02-05T17:52:15.329Z","dependency_job_id":"a97e1e2f-6f88-4d61-b18e-78649e4135c9","html_url":"https://github.com/GovTechSG/apex-signature-validator","commit_stats":null,"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fapex-signature-validator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fapex-signature-validator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fapex-signature-validator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GovTechSG%2Fapex-signature-validator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GovTechSG","download_url":"https://codeload.github.com/GovTechSG/apex-signature-validator/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251758173,"owners_count":21638989,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["angularjs","angularjs1","hmac-sha256","http-signature","jose","rsa-signature","webpack"],"created_at":"2024-11-09T04:11:30.988Z","updated_at":"2025-04-30T18:12:28.153Z","avatar_url":"https://github.com/GovTechSG.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"![APEX Logo](/assets/color_apex_landscape.png)\n\n# APEX Signature and JOSE Validator\n\n[![Codacy Badge](https://api.codacy.com/project/badge/Grade/a20b2416cc2547e9ab6b3ef5669d82ec)](https://app.codacy.com/app/robincher/apex-signature-validator?utm_source=github.com\u0026utm_medium=referral\u0026utm_content=GovTechSG/apex-signature-validator\u0026utm_campaign=badger)\n\nThe Apex Signature Validator is an AngularJS application that assists APEX API consumers in verifying whether signatures are generated correctly in their applications when making restful API calls to the APEX API Gateway. See it in action [here](https://govtechsg.github.io/apex-signature-validator/).\n\nYou can find out more about Apex signature generation from our reference Node.js implementation at https://github.com/GovTechSG/node-apex-api-security.\n\n## Important\n\n- If you are having trouble with [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) when testing your API endpoints, use the [server backed signature validator](https://github.com/govTechSG/apex-signature-validator-server) at https://apex-signature-validator.app.gov.sg. See [the section below for more details](#sending-test-requests-with-the-signature-validator)\n\n- Apex Signature Validator has been tested on Google Chrome, Firefox and Internet Explorer 11.\n\n## Apex signatures explained\n\n[Full documentation for APEX App security](http://docs.akana.com/docs-test/cm/learnmore/app_security.htm)\n\nThere are three components that are of importance when it comes to formulating the correct authorization header: basestring, signature, authorization header.\n\n### Basestring\nEither:\n\n- The string of text (plaintext) that will be used for HMAC-SHA256 generation used in level 1 authentication. A shared key is used to generate this digest.\n\nOr:\n\n- The string of text (plaintext) that will be used to create a SHA256 with RSA signature using the consumer's PEM-formatted private key.\n\nThe composition of the basestring includes: \n\n1. {prefix}_app_id (Generated from the API Gateway)\n2. {prefix}_nonce\n3. {prefix}_signature_method(HmacSHA256 or SHA256withRSA)\n4. {prefix}_timestamp\n5. Any additional parameters (additional parameters do not require a prefix).\n\nAll parameters are ordered by their key names.\nAn example of a basestring is as such:\n\n`\nGET\u0026https://example.com/v1/helloworld/nocors\u0026{prefix}_app_id=appid\u0026{prefix}_nonce=59242635618\u0026\n{prefix}_signature_method=SHA256withRSA\u0026{prefix}_timestamp=1501147626306\u0026{prefix}_version=1.0\u0026\nfirstparam=valueoffirstparam\u0026secondparam=valueofsecondparam\n`\n\n### Signature\nA base64 representation of the digest (HMAC-SHA256 for level 1) or ciphertext (SHA256 with RSA for level 2) derived from the basestring.\n\n### Authorization Header \nThe request authorization header begins with the prefix, the key 'realm' with the value being the api endpoint followed by all the parameters in key-value pairs separated by commas. The generated signature is included as {prefix}_signature. \nAn example of a generated authorization header is as follows:\n\n`\nAuthorization: Apex realm=\"https://example.com/v1/helloworld/nocors\",{prefix}_app_id=appid,{prefix}_nonce=\"98344891638\",{prefix}_signature=\"p1WxtrYhM5L8RkAwQQ59PoZ2+5Yr05kHtC0Bh+nalnPg7SuL4/TTcmxhRmGYioSyYQHoMpKyryx0QbWaBKZDRVK4nIiznJ9L9X+IUAQXMWwSdtjOnjMjgZF06EGfyClFbRIGjJDrbwJeuRutji3/qdj9vZMqXRY/hAwnIfTk7IWPUBd9OrQG0PHMDOREl1mAhABk04MOfTAXCMCwx6z70MoIrc0EhQuuygMertnFS4mU0+hxQtgrPjoDZLPsRgFIkU9iPCKKVAMMc3jAkZq6X8BKImJJB4fXMCv6CfCDwd0PFeY4TG6CFhU7h49XAS+e+sO3HWeCzyXxtinhywIxIw==\",{prefix}_signature_method=\"SHA256withRSA\",{prefix}_timestamp=\"1501225489066\",{prefix}_version=\"1.0\"\n`\n\n## Saving and loading request parameters\n\nIf you have request parameters that are reused often, you can load and save input request parameters in JSON files using the options menu located on the top right.\n\n## Building Apex Signature Validator\nFrom the root directory:\n\n```\n$ npm install\n$ npm run build\n```\n\nThe minified **production** build will be compiled by webpack into the `dist` folder under your project root directory.\n\n## Developing Apex Signature Validator\n\nFrom the project root directory:\n\n```\n$ npm install\n$ npm run devserver\n```\n\nThis spins up a [Webpack Dev Server](https://github.com/webpack/webpack-dev-server) instance that serves the bundled signature validator app (in memory). This server supports live reloading when changes are detected in the code base. You can then access the development build on your browser at `http://localhost:8080` by default.\n\n## Sending test requests with the signature validator\nWhen sending test requests to Apex's gateways, eg. to `api.gov.sg` endpoints, the signature validator's **Send Test Request** function would need to make cross-origin requests. For security reasons, browsers restrict cross-origin HTTP requests initiated using Javascript.\n\nIf you are getting a response code of -1 when sending a test request, your browser could be rejecting your cross-origin request.\n\n## JOSE \n\nJOSE (Javascript Object Signing and Encryption) is an approach to signing and encrypting JSON content. If your API responses are packaged in any of the JOSE standards, you can use this client to further verify or decrpyt the corresponding API response.\n\n### Verifying JWS\n![jose_jws_verified.png](/assets/jose_jws_verified.png)\n\n- Input : JWS API Response from the Gateway. As of now, we are only supporting it in JSON format.\n- Public Certificate/Key : Public certificate that will be used to verify the JSON Web Signature. \n- Output : Data output upon successful verification.\n\n### Decrypting JWE\n![jose_jwe_verified.png](/assets/jose_jwe_verified.png)\n\n- Input : JWE API Response from the Gateway in JSON format.\n- Private Key : Private key that will be used to decrypt the JWE string.\n- Output : Data output upon successful decryption.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgovtechsg%2Fapex-signature-validator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgovtechsg%2Fapex-signature-validator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgovtechsg%2Fapex-signature-validator/lists"}