Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ability to disable servlet request signature verification #163

Merged
merged 1 commit into from
Nov 27, 2018
Merged

Add ability to disable servlet request signature verification #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions ask-sdk-servlet-support/src/com/amazon/ask/servlet/ServletConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,16 @@ public final class ServletConstants {
public static final String SIGNATURE_CERTIFICATE_CHAIN_URL_REQUEST_HEADER =
"SignatureCertChainUrl";

/**
* The name of the system property that can be used to disable request signature verification.
* This feature verifies the certificate authenticity using the configured TrustStore and the
* signature of the skill request, and will throw a {@link SecurityException} if the signature
* does not pass verification. This feature should only be disabled in testing scenarios and
* never in a production environment.
*/
public static final String DISABLE_REQUEST_SIGNATURE_CHECK_SYSTEM_PROPERTY =
"com.amazon.ask.servlet.disableRequestSignatureCheck";

/**
* The name of the system property that can be used to configure the timestamp tolerance (in
* millis) of the {@link SkillServlet}. Requests with timestamps outside of this inclusive tolerance range,
Expand Down
4 changes: 3 additions & 1 deletion ask-sdk-servlet-support/src/com/amazon/ask/servlet/SkillServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,9 @@ public class SkillServlet extends HttpServlet {

public SkillServlet(Skill skill) {
List<SkillServletVerifier> defaultVerifiers = new ArrayList<>();
defaultVerifiers.add(new SkillRequestSignatureVerifier());
if (!Boolean.parseBoolean(System.getProperty(ServletConstants.DISABLE_REQUEST_SIGNATURE_CHECK_SYSTEM_PROPERTY))) {
defaultVerifiers.add(new SkillRequestSignatureVerifier());
}
Long timestampToleranceProperty = ServletUtils.getSystemPropertyAsLong(TIMESTAMP_TOLERANCE_SYSTEM_PROPERTY);
defaultVerifiers.add(new SkillRequestTimestampVerifier(timestampToleranceProperty != null
? timestampToleranceProperty : DEFAULT_TOLERANCE_MILLIS));
Expand Down