`Trusted Entitlements`: add support for signing request headers #3424

NachoSoto · 2023-11-16T19:25:42Z

This adds support for including arbitrary headers in the signature verification, therefore preventing tampering of them.

...gApps/PurchaseTesterSwiftUI/PurchaseTester.xcworkspace/xcshareddata/swiftpm/Package.resolved

NachoSoto · 2023-11-17T17:34:56Z

Sources/Networking/HTTPClient/HTTPClient.swift

@@ -148,6 +148,14 @@ extension HTTPClient {
        }
    }

+    static func headerParametersForSignatureHeader(with headers: RequestHeaders) -> RequestHeaders {
+        if let header = HTTPRequest.headerParametersForSignatureHeader(headers: headers) {
+            return [RequestHeader.headerParametersForSignature.rawValue: header]


This is tested by snapshot tests.

Tests/UnitTests/Mocks/MockHTTPClient.swift

This allows us to verify exactly what headers are included in all requests. It also simplifies the implementation for #3424.

…er hash Follow up to #3424. This adds coverage to ensure that the backend continues to sign correctly for old SDK versions that don't support this.

NachoSoto · 2023-12-08T20:40:16Z

Sources/Security/HTTPRequest+Signing.swift

+    }
+
+    @available(iOS 13.0, macOS 10.15, tvOS 13.0, watchOS 6.2, *)
+    static func signingParameterHash(_ values: [String]) -> String {


This is now a shared method for both POST body and header parameters.

NachoSoto · 2023-12-08T20:40:46Z

Sources/Security/Signing.swift

@@ -276,6 +283,7 @@ extension Signing.SignatureParameters {
            nonce +
            path +
            postParameterHash +
+            headerParametersHash +


Thanks to unit tests I was able to get this right. Initially I had this before the post hash.

NachoSoto · 2023-12-08T20:41:07Z

Tests/UnitTests/Security/SigningTests.swift

+        let response = """
+        {"request_date":"2023-12-08T19:17:04Z","request_date_ms":1702063024731,"subscriber":{"entitlements":{},"first_seen":"2023-12-08T19:13:02Z","last_seen":"2023-12-08T19:13:02Z","management_url":null,"non_subscriptions":{},"original_app_user_id":"$RCAnonymousID:6ca4535c42714f88abc99c563703f113","original_application_version":null,"original_purchase_date":null,"other_purchases":{},"subscriptions":{}}}\n
+        """
+        let expectedSignature = "x2qnlHOl5WuzGi4TbSUVHxzlKELRCfrRYG9XAiso7ucZTQAAYEZqbguA3X0YfCJqCKh2hnTLSdEr4R+t23xBlTxceWZu2TJjK3461UJKpUnrwXDv+tYo2K54IoS3/tsEr3VmB5ppKAq0P2CR7SwbsDPpxUlHBcl5/4XJvb/DHOnTKjIVd4WJ+57LLWvIV9sDHnj9XxiBez+p5cEjez1RtUis0XdCfAFXU8XfAq6ggiEJKX4F"


I've generated these from the backend, so we can confirm that these real signatures are valid.

Sources/Security/HTTPRequest+Signing.swift

…er hash Follow up to #3424. This adds coverage to ensure that the backend continues to sign correctly for old SDK versions that don't support this.

tonidero

Looks great!

tonidero · 2023-12-19T09:07:33Z

Sources/Security/HTTPRequest+Signing.swift

+
+extension HTTPRequest {
+
+    static func headerParametersForSignatureHeader(headers: Headers) -> String? {


Hmm this name sounds weird to me... Maybe headerParametersHeaderForSigning? (To mimick postParametersHeaderForSigning

I was trying to avoid the double "header" word in headerParametersHeaderForSigning, which I think reads kinda confusingly :/

Hmm yeah... Not sure... maybe it's ok as it is. FFTI

tonidero · 2023-12-19T09:11:37Z

Sources/Networking/HTTPClient/HTTPClient.swift

-           self.path.supportsSignatureVerification,
-           let body = self.requestBody {
+           self.path.supportsSignatureVerification {
+            result += HTTPClient.headerParametersForSignatureHeader(with: defaultHeaders)


FFTI I was wondering whether we should pass the result headers instead of only the defaultHeaders to future-proof it in case we need to sign any of the other headers... This should work for now though.

Yeah if we need to that will get caught by tests, so we can change this to support that.

…er hash Follow up to #3424. This adds coverage to ensure that the backend continues to sign correctly for old SDK versions that don't support this.

@NachoSoto

…s-15 (#3501) Requested by @NachoSoto for [trusted-entitlements-headers](https://github.com/RevenueCat/purchases-ios/tree/trusted-entitlements-headers) Co-authored-by: Distiller <distiller@static.38.23.39.57.cyberlynk.net>

…er hash Follow up to #3424. This adds coverage to ensure that the backend continues to sign correctly for old SDK versions that don't support this.

NachoSoto · 2023-12-20T21:56:40Z

This should be ready, but the signature is still wrong on the load shedder

codecov · 2023-12-21T19:51:43Z

Codecov Report

Attention: 2 lines in your changes are missing coverage. Please review.

Comparison is base (275e21b) 85.97% compared to head (730c8b5) 86.02%.
Report is 5 commits behind head on main.

Files	Patch %	Lines
Sources/Security/HTTPRequest+Signing.swift	95.55%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3424      +/-   ##
==========================================
+ Coverage   85.97%   86.02%   +0.05%     
==========================================
  Files         240      241       +1     
  Lines       17494    17552      +58     
==========================================
+ Hits        15040    15099      +59     
+ Misses       2454     2453       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

NachoSoto · 2023-12-21T19:52:07Z

Merging this! 🎉

…er hash Follow up to #3424. This adds coverage to ensure that the backend continues to sign correctly for old SDK versions that don't support this.

…er hash (#3505) Follow up to #3424. This adds coverage to ensure that the backend continues to sign correctly for old SDK versions that don't support this.

aboedo

I'm late to the game but great work on this!

@NachoSoto

**This is an automatic release.** ### RevenueCatUI * `Paywalls`: add header image to `watchOS` paywalls (#3542) via NachoSoto (@NachoSoto) * `Paywalls`: improve template 5 landscape layout (#3534) via NachoSoto (@NachoSoto) * `Paywalls`: fix template 5 footer loading view alignment (#3537) via NachoSoto (@NachoSoto) * `Paywalls`: improve template 1 landscape layout (#3532) via NachoSoto (@NachoSoto) * `Paywalls`: fix `ColorInformation.multiScheme` on `watchOS` (#3530) via NachoSoto (@NachoSoto) ### Other Changes * `Trusted Entitlements`: tests for signature verification without header hash (#3505) via NachoSoto (@NachoSoto) * `.debugRevenueCatOverlay`: added `Locale` (#3539) via NachoSoto (@NachoSoto) * `Trusted Entitlements`: add support for signing request headers (#3424) via NachoSoto (@NachoSoto) * `CI`: Add architecture to cache keys (#3538) via Mark Villacampa (@MarkVillacampa) * `Paywalls Tester`: remove double close button (#3531) via NachoSoto (@NachoSoto) * Fix `RevenueCatUI` snapshot tests (#3526) via NachoSoto (@NachoSoto)

NachoSoto added the refactor A code change that neither fixes a bug nor adds a feature label Nov 16, 2023

NachoSoto requested a review from a team November 16, 2023 19:25

NachoSoto force-pushed the trusted-entitlements-headers branch from 03c29a7 to beb69fc Compare November 16, 2023 19:37

NachoSoto mentioned this pull request Nov 16, 2023

HTTPClient: test all request headers #3425

Merged

NachoSoto changed the base branch from main to http-client-test-headers November 16, 2023 21:42

NachoSoto force-pushed the trusted-entitlements-headers branch 2 times, most recently from 658c490 to b777a9f Compare November 16, 2023 21:47

NachoSoto force-pushed the http-client-test-headers branch 2 times, most recently from 700fc54 to 50ad627 Compare November 16, 2023 23:07

NachoSoto force-pushed the trusted-entitlements-headers branch from b777a9f to 958a5a9 Compare November 17, 2023 17:29

NachoSoto commented Nov 17, 2023

View reviewed changes

...gApps/PurchaseTesterSwiftUI/PurchaseTester.xcworkspace/xcshareddata/swiftpm/Package.resolved Outdated Show resolved Hide resolved

NachoSoto commented Nov 17, 2023

View reviewed changes

NachoSoto force-pushed the http-client-test-headers branch from 26c660b to 5d0afcb Compare November 17, 2023 18:43

NachoSoto force-pushed the trusted-entitlements-headers branch from 958a5a9 to 01268ef Compare November 17, 2023 20:00

NachoSoto commented Nov 17, 2023

View reviewed changes

Tests/UnitTests/Mocks/MockHTTPClient.swift Outdated Show resolved Hide resolved

Base automatically changed from http-client-test-headers to main November 17, 2023 20:19

NachoSoto added a commit that referenced this pull request Nov 17, 2023

HTTPClient: test all request headers (#3425)

e31a531

This allows us to verify exactly what headers are included in all requests. It also simplifies the implementation for #3424.

NachoSoto force-pushed the trusted-entitlements-headers branch from 01268ef to 7a2c93b Compare November 17, 2023 20:20

NachoSoto force-pushed the trusted-entitlements-headers branch 3 times, most recently from 9ec2f4b to 132dca7 Compare December 8, 2023 19:23

NachoSoto mentioned this pull request Dec 8, 2023

Trusted Entitlements: tests for signature verification without header hash #3505

Merged

NachoSoto changed the title ~~[WIP] Trusted Entitlements: add support for signing request headers~~ Trusted Entitlements: add support for signing request headers Dec 8, 2023

NachoSoto marked this pull request as ready for review December 8, 2023 20:39

NachoSoto commented Dec 8, 2023

View reviewed changes

NachoSoto force-pushed the trusted-entitlements-headers branch 2 times, most recently from 03c0f9f to ad9af4c Compare December 8, 2023 23:37

bisho reviewed Dec 9, 2023

View reviewed changes

Sources/Security/HTTPRequest+Signing.swift Outdated Show resolved Hide resolved

NachoSoto force-pushed the trusted-entitlements-headers branch from d36a5a4 to 57f4e8a Compare December 9, 2023 01:27

tonidero approved these changes Dec 19, 2023

View reviewed changes

NachoSoto added the blocked label Dec 19, 2023

NachoSoto force-pushed the trusted-entitlements-headers branch 2 times, most recently from 33a7047 to 26eb5bf Compare December 20, 2023 20:58

NachoSoto and others added 7 commits December 20, 2023 13:06

[skip ci] WIP

f44ae61

Unit tests and fix implementation

e5e97d9

Remove TODOs

6378a48

Fix hash generation to be ordered

4f76ca9

Simplified method

31e9332

Disable hashing for static signatures

730c8b5

NachoSoto force-pushed the trusted-entitlements-headers branch from 26eb5bf to 730c8b5 Compare December 20, 2023 21:07

NachoSoto merged commit fb76e66 into main Dec 21, 2023
22 checks passed

NachoSoto deleted the trusted-entitlements-headers branch December 21, 2023 19:53

NachoSoto removed the blocked label Dec 21, 2023

RCGitBot mentioned this pull request Dec 21, 2023

[AUTOMATIC] Release/4.31.6 #3543

Closed

aboedo reviewed Dec 21, 2023

View reviewed changes

RCGitBot mentioned this pull request Dec 21, 2023

[AUTOMATIC] Release/4.31.6 #3544

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`Trusted Entitlements`: add support for signing request headers #3424

`Trusted Entitlements`: add support for signing request headers #3424

NachoSoto commented Nov 16, 2023 •

edited

Loading

NachoSoto Nov 17, 2023

NachoSoto Dec 8, 2023

NachoSoto Dec 8, 2023

NachoSoto Dec 8, 2023

tonidero left a comment

tonidero Dec 19, 2023

NachoSoto Dec 19, 2023

tonidero Dec 20, 2023 •

edited

Loading

tonidero Dec 19, 2023

NachoSoto Dec 19, 2023

NachoSoto commented Dec 20, 2023

codecov bot commented Dec 21, 2023

NachoSoto commented Dec 21, 2023

aboedo left a comment •

edited

Loading


		extension HTTPRequest {

		static func headerParametersForSignatureHeader(headers: Headers) -> String? {

Trusted Entitlements: add support for signing request headers #3424

Trusted Entitlements: add support for signing request headers #3424

Conversation

NachoSoto commented Nov 16, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tonidero left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tonidero Dec 20, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NachoSoto commented Dec 20, 2023

codecov bot commented Dec 21, 2023

Codecov Report

NachoSoto commented Dec 21, 2023

aboedo left a comment • edited Loading

Choose a reason for hiding this comment

`Trusted Entitlements`: add support for signing request headers #3424

`Trusted Entitlements`: add support for signing request headers #3424

NachoSoto commented Nov 16, 2023 •

edited

Loading

tonidero Dec 20, 2023 •

edited

Loading

aboedo left a comment •

edited

Loading