(JavaScript) Plaza API (bol.com) HMAC-SHA256 Authentication

Demonstrates how to compute the Authorization header for bol.com using HMAC-SHA256.

Note

This example is intended for running within a Chilkat.Js embedded JavaScript engine. All Chilkat JavaScript examples require Chilkat v11.4.0 or greater.

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

var crypt = new CkCrypt2();

crypt.EncodingMode = "base64";
crypt.HashAlgorithm = "sha256";
crypt.MacAlgorithm = "hmac";

var publicKey = "oRNWbHFXtAECmhnZmEndcjLIaSKbRMVE";
var privateKey = "MaQHPOnmYkPZNgeRziPnQyyOJYytUbcFBVJBvbMKoDdpPqaZbaOiLUTWzPAkpPsZFZbJHrcoltdgpZolyNcgvvBaKcmkqFjucFzXhDONTsPAtHHyccQlLUZpkOuywMiOycDWcCySFsgpDiyGnCWCZJkNTtVdPxbSUTWVIFQiUxaPDYDXRQAVVTbSVZArAZkaLDLOoOvPzxSdhnkkJWzlQDkqsXNKfAIgAldrmyfROSyCGMCfvzdQdUQEaYZTPEoA";

// The string to sign is this:
// http_verb +'\n\n'+ content_type +'\n'+ x_bol_date +'\n'+ 'x-bol-date:'+ x_bol_date +'\n'+ uri

var http_verb = "GET";
var content_type = "application/xml";
var x_bol_date = "Wed, 17 Feb 2016 00:00:00 GMT";
var uri = "/services/rest/orders/v2";

// IMPORTANT: Notice the use of underscore and hyphen (dash) chars in x-bol-date vs. x_bol_date.
// In one place hypens are used.  In two places, underscore chars are used.
var sb = new CkStringBuilder();
sb.Append(http_verb);
sb.Append("\n\n");
sb.Append(content_type);
sb.Append("\n");
sb.Append(x_bol_date);
sb.Append("\nx-bol-date:");
sb.Append(x_bol_date);
sb.Append("\n");
sb.Append(uri);
console.log("[" + sb.GetAsString() + "]");

// Set the HMAC key:
crypt.SetMacKeyEncoded(privateKey,"ascii");
var mac = crypt.MacStringENC(sb.GetAsString());

// The answer should be: nqzLWvXI1eBhBXrRx5NF23V5hS8Q1xWCloJzPi/RAts=
console.log(mac);

// The last step is to append the public key with the signature
var sbHeader = new CkStringBuilder();
sbHeader.Append(publicKey);
sbHeader.Append(":");
sbHeader.Append(mac);

var hdrValue = sbHeader.GetAsString();
console.log(hdrValue);