Skip to content

Commit

Permalink
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,21 +15,21 @@ This Java SDK is designed to simplify the process of generating digital signatur

Due to regulatory requirements emanating from SCA for our European/UK sellers, we are requiring our developers to add a digital signature for every HTTP call that is made on behalf of a EU/UK seller to certain APIs.

This SDK is generic and the signature scheme is compliant with these upcoming IETF standards (currently not yet RFCs).
This SDK is generic and the signature scheme is compliant with these upcoming IETF standards.

* [draft-ietf-httpbis-message-signatures-13](https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-13.html)
* [draft-ietf-httpbis-digest-headers-10](https://www.ietf.org/archive/id/draft-ietf-httpbis-digest-headers-10.html)
* [RFC 9421 HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421.html)
* [RFC 9530 Digest Fields](https://www.rfc-editor.org/rfc/rfc9530.html)

## Features

This SDK is intended to generate required message signature headers, as per the above IEFT standards, and also provides a way to verfiy signature headers. There is also an example Spring Boot service included with the SDK.
This SDK is intended to generate required message signature headers, as per the above IETF standards, and also provides a way to verfiy signature headers. There is also an example Spring Boot service included with the SDK.

This SDK incorporates

* Generation of the following HTTP message signature headers:
* **Content-Digest**: This header includes a SHA-256 digest over the HTTP payload (as specified in [draft-ietf-httpbis-digest-headers-10](https://www.ietf.org/archive/id/draft-ietf-httpbis-digest-headers-10.html)), if any. It is not required to be sent for APIs that do not include a request payload (e.g. GET requests).
* **Signature-Input**: This header indicates which headers and pseudo-headers are included, as well as the order in which they are used when calculating the signature. It is created as specified in [draft-ietf-httpbis-message-signatures-13](https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-13.html)
* **Signature**: The value of the Signature header is created as described in [Section 3.1, Creating a Signature](https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-13.html#name-creating-a-signature), of IETF draft-ietf-httpbis-message-signatures-13. It uses the Private Key value generated by the [Key Management API](https://developer.ebay.com/api-docs/developer/key-management/overview.html).
* **Content-Digest**: This header includes a SHA-256 digest over the HTTP payload (as specified in [RFC 9530 Digest Fields](https://www.rfc-editor.org/rfc/rfc9530.html)), if any. It is not required to be sent for APIs that do not include a request payload (e.g. GET requests).
* **Signature-Input**: This header indicates which headers and pseudo-headers are included, as well as the order in which they are used when calculating the signature. It is created as specified in [RFC 9421 HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421.html)
* **Signature**: The value of the Signature header is created as described in [Section 3.1, Creating a Signature, of RFC9421](https://www.rfc-editor.org/rfc/rfc9421.html#name-creating-a-signature). It uses the Private Key value generated by the [Key Management API](https://developer.ebay.com/api-docs/developer/key-management/overview.html).
* **x-ebay-signature-key**: This header includes the JWE that is created using the [Key Management API](https://developer.ebay.com/api-docs/developer/key-management/overview.html)
* `getSignedRequest` method to sign the incoming request object
* `validateSignature` method to validate the signature of the incoming request object
Expand Down

0 comments on commit e161187

Please sign in to comment.