php curl response is blank

Max Daneshvar

I am initiating the integration to World-Check One and right off the bat I am facing an issue with getting no response when I make a GET request through php cURL. I have followed the postman collection, and used the php cURL that was generated in there. Postman gives the response while my code doesn't. I have tested the base64_encode of hmac-sha256 as well and all are being generated as expected in the private functions of the class.

The last function is what I am calling for getting the list of groups.

Here is my code:

class ThomsonReutersHelper
{
    /**
     * Generate header signature
     *
     * @param $dataToSign
     * @return string
     */
    private function generateAuthHeader($dataToSign)
    {
        if(!($secret = config('app.tr_secret'))){
            Log::warning('[TR-generateAuthHeader] Missing app secret.');
            return forbiddenError('Missing TR Secret.');
        }
        try{
            return base64_encode(hash_hmac('sha256', $dataToSign, $secret));
        }
        catch (\Exception $e){
            Log::error('[TR-generateAuthHeader] failed.',[$e->getMessage()]);
            return serverError('Failed to generate auth header.');
        }
    }

    private function dataToSign($endpoint, $date)
    {
        if(!($url = config('app.tr_url'))){
            Log::warning('[TR-dataToSign] Missing TR url.');
            return forbiddenError('Missing URL.');
        }
        if(!($host = config('app.tr_host'))){
            Log::warning('[TR-dataToSign] Missing TR host.');
            return forbiddenError('Missing Host.');
        }

        return "(request-target): get " . $url . "$endpoint\n"."host: $host\n"."date: $date";
    }

    private function getHeaderData($endpoint)
    {
        if(!($key = config('app.tr_key'))){
            Log::warning('[TR-getHeaderData] Missing TR key.');
            return forbiddenError('Missing key.');
        }
        $date = gmdate('D, d M Y H:i:s').' GMT';
        $authorization = "Signature keyId=\"" . $key . "\",algorithm=\"hmac-sha256\",headers=\"(request-target) host date\",signature=\"" . $this->generateAuthHeader($this->dataToSign($endpoint, $date)) . "\"";
        return [
            'authorization' => $authorization,
            'date' => $date
        ];
    }

    public function test(){
        $endpoint = 'groups';
        $headers = $this->getHeaderData($endpoint);
        $curl = curl_init();
        curl_setopt_array($curl, array(
            CURLOPT_URL => config('app.tr_host').config('app.tr_url').$endpoint,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_ENCODING => "",
            CURLOPT_MAXREDIRS => 10,
            CURLOPT_TIMEOUT => 30,
            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
            CURLOPT_CUSTOMREQUEST => "GET",
            CURLOPT_HTTPHEADER => array(
                "Authorization: ".$headers['authorization'],
                "Cache-Control: no-cache",
                "Content-Type: application/json",
                $headers['date']
            ),
        ));

        $response = curl_exec($curl);
        $errno = curl_errno($curl);
        $err = curl_error($curl);

        curl_close($curl);

        if ($errno) {
            return "cURL Error #:" . $err;
        } else {
            return $response;
        }
    }
}

Max Daneshvar

Ok so the problem with generating the signature was:

• Under generateAuthHeader function, forth parameter was required to be true ($hmac = hash_hmac('sha256', $dataToSign, $secret, true);)
• The dataToSign() function should return in this format: return "(request-target): get $url$endpoint\nhost: $host\ndate: $date";