Springboot Java AuthorisationHeader error 401 for Linux

jorgemedina

Hi, My name is Jorge and I'm trying to connect with World check API. The issue is: we are always getting a 401 authorisation error, but just for linux.

We have our service running in windows and we dont have any issue running it in our local environment (Windows).

When we deploy it to our DEV environment which is in Linux we are getting a 401 error, the same keys, the same code, without any change.

We already tried some different logics. Seems to be a problem with break line - "\n" in the Data to Sign string. We tried "\n" or System.lineSeparator().

//we need to keep System.lineSeparator for linux, we cannot put "\n" directly in the string.
        String breakLine = System.lineSeparator();
        switch (method){
            case GET:
                requestDataToSign = "(request-target): get " + gatewayUrl + path + breakLine +
                        "host: " + gatewayHost + breakLine +
                        "date: " + date;
                break;
            case POST:
                requestDataToSign = "(request-target): post " + gatewayUrl + path + breakLine +
                        "host: " + gatewayHost + breakLine +
                        "date: " + date;
                if(StringUtils.hasLength(bodyString)){
                    requestDataToSign +=
                            breakLine + "content-type: " + MediaType.APPLICATION_JSON_VALUE + breakLine +
                                    "content-length: " + contentLength + breakLine +
                                    bodyString;
                    requestDataHeaders=Constants.REQUEST_HEADERS_WITH_BODY;
                }

        }
        log.debug("Request sign {}", requestDataToSign);
        return signRequestData(requestDataToSign,requestDataHeaders,apiKey,apiSecret);

private String signRequestData(String dataToSign, String requestHeaders, String apiKey, String apiSecret) {
        String hmac = generateAuthHeader(dataToSign, apiSecret);
        return "Signature keyId=\"" + apiKey + "\",algorithm=\"hmac-sha256\",headers=\"(request-target) " + requestHeaders + "\",signature=\"" + hmac + "\"";
    }

private String generateAuthHeader(String dataToSign, String apiSecret)
    {
        String hash = "";
        try {

            Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secret_key = new SecretKeySpec(apiSecret.getBytes(), "HmacSHA256");
            sha256_HMAC.init(secret_key);
            log.info("Charset.defaultCharset().toString() {}" , Charset.defaultCharset().toString());
            hash = Base64.getEncoder().encodeToString(sha256_HMAC.doFinal(dataToSign.getBytes(StandardCharsets.UTF_8)));
        }
        catch (Exception e){
            log.error(e.getMessage(), (Object[]) e.getStackTrace());
        }
        return(hash);
    }

How do you suggest to create this Authorization String? to work in windows and linux.

Would be great if it's possible to have a teams call to be easier to show and communicate this issue. We are struggling with this and we have a data for the deploy.

Thank you

Jorge Medina

Vivek Kumar Singh

Hi @jorgemedina

Thanks for sharing the requested details.

When you get the 401 which means that the request has failed an authorization check. This can happen for a variety of reasons, such as an invalid or expired API key, an invalid HMAC signature or a request timing issue/problem with the Date header value.

Therefore, I have validated your Linux request header and response header and found out that the clock is not synchronized as you can see that there is ~2 minutes difference between the request header and the response header (it shouldn't be more than 30 seconds), hence you are getting the 401 error. You should ensure a correctly synchronized clock is used to generate request timestamps.

Thanks
Vivek Kumar Singh