signer

func BuildClientRequestAuthorization ¶

func BuildClientRequestAuthorization(r *http.Request, accessKey string, secretKey []byte) (string, error)

func BuildRequestHMAC ¶

func BuildRequestHMAC(r *http.Request, requestBody io.Reader, key []byte) []byte

BuildRequestHMAC builds a request HMAC from a secret key to authenticate a request for /api endpoints This function is shared by both client code to authenticate requests, and server to validate requests

The return value is

base64(hmac-sha-256(VERB + "\n" +
                    REQUEST_PATH + "\n" +
                    DATE + "\n" +
                    sha256(REQUEST_BODY)
))

It uses a separate requestBody argument instead of r.Body since reading from r.Body in both client & server will prevent reading the body again. Therefore it is the caller's responsibility to provide a separate request body reader. This is done by calling r.GetBody() on the client, and by reading request body to disk on server requests