Java Requires Chilkat v11.0.0+

Signing HTTP Messages

See more RSA Examples

Demonstrates how to sign HTTP messages per draft-cavage-http-signatures-10 Chilkat2 Java

import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.DateTime;
import com.chilkatsoft.chilkat2.PrivateKey;
import com.chilkatsoft.chilkat2.PublicKey;
import com.chilkatsoft.chilkat2.Rsa;
import com.chilkatsoft.chilkat2.StringBuilder;

public class ChilkatExample {

    public static void main(String[] args) {
        // This example requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        boolean bCrlf = true;
        StringBuilder sbPublicKeyPem = new StringBuilder();
        sbPublicKeyPem.appendLine("-----BEGIN PUBLIC KEY-----", bCrlf);
        sbPublicKeyPem.appendLine("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCFENGw33yGihy92pDjZQhl0C3", bCrlf);
        sbPublicKeyPem.appendLine("6rPJj+CvfSC8+q28hxA161QFNUd13wuCTUcq0Qd2qsBe/2hFyc2DCJJg0h1L78+6", bCrlf);
        sbPublicKeyPem.appendLine("Z4UMR7EOcpfdUE9Hf3m/hs+FUR45uBJeDK1HSFHD8bHKD6kv8FPGfJTotc+2xjJw", bCrlf);
        sbPublicKeyPem.appendLine("oYi+1hqp1fIekaxsyQIDAQAB", bCrlf);
        sbPublicKeyPem.appendLine("-----END PUBLIC KEY-----", bCrlf);

        PublicKey pubKey = new PublicKey();
        pubKey.loadFromString(sbPublicKeyPem.getAsString());

        StringBuilder sbPrivateKeyPem = new StringBuilder();
        sbPrivateKeyPem.appendLine("-----BEGIN RSA PRIVATE KEY-----", bCrlf);
        sbPrivateKeyPem.appendLine("MIICXgIBAAKBgQDCFENGw33yGihy92pDjZQhl0C36rPJj+CvfSC8+q28hxA161QF", bCrlf);
        sbPrivateKeyPem.appendLine("NUd13wuCTUcq0Qd2qsBe/2hFyc2DCJJg0h1L78+6Z4UMR7EOcpfdUE9Hf3m/hs+F", bCrlf);
        sbPrivateKeyPem.appendLine("UR45uBJeDK1HSFHD8bHKD6kv8FPGfJTotc+2xjJwoYi+1hqp1fIekaxsyQIDAQAB", bCrlf);
        sbPrivateKeyPem.appendLine("AoGBAJR8ZkCUvx5kzv+utdl7T5MnordT1TvoXXJGXK7ZZ+UuvMNUCdN2QPc4sBiA", bCrlf);
        sbPrivateKeyPem.appendLine("QWvLw1cSKt5DsKZ8UETpYPy8pPYnnDEz2dDYiaew9+xEpubyeW2oH4Zx71wqBtOK", bCrlf);
        sbPrivateKeyPem.appendLine("kqwrXa/pzdpiucRRjk6vE6YY7EBBs/g7uanVpGibOVAEsqH1AkEA7DkjVH28WDUg", bCrlf);
        sbPrivateKeyPem.appendLine("f1nqvfn2Kj6CT7nIcE3jGJsZZ7zlZmBmHFDONMLUrXR/Zm3pR5m0tCmBqa5RK95u", bCrlf);
        sbPrivateKeyPem.appendLine("412jt1dPIwJBANJT3v8pnkth48bQo/fKel6uEYyboRtA5/uHuHkZ6FQF7OUkGogc", bCrlf);
        sbPrivateKeyPem.appendLine("mSJluOdc5t6hI1VsLn0QZEjQZMEOWr+wKSMCQQCC4kXJEsHAve77oP6HtG/IiEn7", bCrlf);
        sbPrivateKeyPem.appendLine("kpyUXRNvFsDE0czpJJBvL/aRFUJxuRK91jhjC68sA7NsKMGg5OXb5I5Jj36xAkEA", bCrlf);
        sbPrivateKeyPem.appendLine("gIT7aFOYBFwGgQAQkWNKLvySgKbAZRTeLBacpHMuQdl1DfdntvAyqpAZ0lY0RKmW", bCrlf);
        sbPrivateKeyPem.appendLine("G6aFKaqQfOXKCyWoUiVknQJAXrlgySFci/2ueKlIE1QqIiLSZ8V8OlpFLRnb1pzI", bCrlf);
        sbPrivateKeyPem.appendLine("7U1yQXnTAEFYM560yJlzUpOb1V4cScGd365tiSMvxLOvTA==", bCrlf);
        sbPrivateKeyPem.appendLine("-----END RSA PRIVATE KEY-----", bCrlf);

        PrivateKey privKey = new PrivateKey();
        privKey.loadPem(sbPrivateKeyPem.getAsString());

        //    All examples use this request:
        //
        //    POST /foo?param=value&pet=dog HTTP/1.1
        //    Host: example.com
        //    Date: Sun, 05 Jan 2014 21:31:40 GMT
        //    Content-Type: application/json
        //    Digest: SHA-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=
        //    Content-Length: 18
        //
        //    {"hello": "world"}

        // C.1.  Default Test
        //
        //    If a list of headers is not included, the date is the only header
        //    that is signed by default.  The string to sign would be:
        //
        //    date: Sun, 05 Jan 2014 21:31:40 GMT
        //
        //    The Authorization header would be:
        //
        //    Authorization: Signature keyId="Test",algorithm="rsa-sha256",
        //    signature="SjWJWbWN7i0wzBvtPl8rbASWz5xQW6mcJmn+ibttBqtifLN7Sazz
        //    6m79cNfwwb8DMJ5cou1s7uEGKKCs+FLEEaDV5lp7q25WqS+lavg7T8hc0GppauB
        //    6hbgEKTwblDHYGEtbGmtdHgVCk9SuS13F0hZ8FD0k/5OxEPXe5WozsbM="
        //
        //    The Signature header would be:
        //
        //    Signature: keyId="Test",algorithm="rsa-sha256",
        //    signature="SjWJWbWN7i0wzBvtPl8rbASWz5xQW6mcJmn+ibttBqtifLN7Sazz
        //    6m79cNfwwb8DMJ5cou1s7uEGKKCs+FLEEaDV5lp7q25WqS+lavg7T8hc0GppauB
        //    6hbgEKTwblDHYGEtbGmtdHgVCk9SuS13F0hZ8FD0k/5OxEPXe5WozsbM="
        //

        DateTime dtNow = new DateTime();
        dtNow.setFromCurrentSystemTime();
        String dateStr = dtNow.getAsRfc822(false);

        // To duplicate the above result, we'll hard-code the date string.
        dateStr = "Sun, 05 Jan 2014 21:31:40 GMT";

        Rsa rsa = new Rsa();
        try {
            rsa.usePrivateKey(privKey);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        StringBuilder sbStringToSign = new StringBuilder();
        sbStringToSign.append("date: ");
        sbStringToSign.append(dateStr);

        rsa.setEncodingMode("base64");
        String b64Signature = rsa.signStringENC(sbStringToSign.getAsString(), "SHA256");
        System.out.println(b64Signature);
        System.out.println("---------------------------");

        // The result should be:
        // SjWJWbWN7i0wzBvtPl8rbASW ... FD0k/5OxEPXe5WozsbM=

        // ----------------------------------------------------------------------------------------------------

        // C.2.  Basic Test
        //
        //    The minimum recommended data to sign is the (request-target), host,
        //    and date.  In this case, the string to sign would be:
        //
        //    (request-target): post /foo?param=value&pet=dog
        //    host: example.com
        //    date: Sun, 05 Jan 2014 21:31:40 GMT
        //
        //    The Authorization header would be:
        //
        //    Authorization: Signature keyId="Test",algorithm="rsa-sha256",
        //    headers="(request-target) host date", signature="qdx+H7PHHDZgy4
        //    y/Ahn9Tny9V3GP6YgBPyUXMmoxWtLbHpUnXS2mg2+SbrQDMCJypxBLSPQR2aAjn
        //    7ndmw2iicw3HMbe8VfEdKFYRqzic+efkb3nndiv/x1xSHDJWeSWkx3ButlYSuBs
        //    kLu6kd9Fswtemr3lgdDEmn04swr2Os0="

        sbStringToSign.clear();
        sbStringToSign.append("(request-target): ");
        sbStringToSign.appendLine("post /foo?param=value&pet=dog", false);
        sbStringToSign.append("host: ");
        sbStringToSign.appendLine("example.com", false);
        sbStringToSign.append("date: ");
        sbStringToSign.append(dateStr);

        System.out.println("StringToSign:");
        System.out.println(sbStringToSign.getAsString());
        b64Signature = rsa.signStringENC(sbStringToSign.getAsString(), "SHA256");
        System.out.println(b64Signature);
        System.out.println("---------------------------");

        // The result should be:
        // qdx+H7PHHDZgy4y/Ahn ... mn04swr2Os0=
    }
}