From bd08a691ca66f20b3551d498ae97a5d30bf0026c Mon Sep 17 00:00:00 2001 From: Jake Urban <10968980+JakeUrban@users.noreply.github.com> Date: Tue, 10 Jan 2023 14:24:36 -0800 Subject: [PATCH] SEP-6,12,24,31: allow omission of X-Stellar-Signature (#1335) --- ecosystem/sep-0006.md | 13 +++++++------ ecosystem/sep-0012.md | 13 ++++++++----- ecosystem/sep-0024.md | 13 +++++++------ ecosystem/sep-0031.md | 13 ++++++++----- 4 files changed, 30 insertions(+), 22 deletions(-) diff --git a/ecosystem/sep-0006.md b/ecosystem/sep-0006.md index 196f015fe..dfb467a29 100644 --- a/ecosystem/sep-0006.md +++ b/ecosystem/sep-0006.md @@ -6,8 +6,8 @@ Title: Deposit and Withdrawal API Author: SDF Status: Active (Interactive components are deprecated in favor of SEP-24) Created: 2017-10-30 -Updated: 2023-01-06 -Version 3.17.0 +Updated: 2023-01-10 +Version 3.17.1 ``` ## Simple Summary @@ -158,9 +158,9 @@ This protocol involves the transfer of value, and so HTTPS is required for all e ## Callback signature -This protocol involves the optional use of callbacks that the Anchor can issue to update the wallet on `status` of a transaction. In order to validate the integrity and provenance of the callback, the Anchor MUST include a signature in the HTTP Header `Signature` and `X-Stellar-Signature` (deprecated). +This protocol involves the optional use of callbacks that the Anchor can issue to update the wallet on `status` of a transaction. In order to validate the integrity and provenance of the callback, the Anchor MUST include a signature in the HTTP Header `Signature` or `X-Stellar-Signature` (deprecated). -Anchors and wallets should support both headers until the `X-Stellar-Signature` header is removed for the sake of ecosystem compatibility. +Wallets should support both headers until the `X-Stellar-Signature` header is removed from the specification. These headers MUST follow the specification: `t=, s=` where: * __timestamp__ is the current Unix timestamp (number of seconds since epoch) at the time the callback is sent. This is used to assure the freshness of the request and to prevent this request to be replayed in the future. @@ -173,7 +173,7 @@ It is the wallet's responsibility to: ### VERIFY signature -* Check that callback request has `Signature` and `X-Stellar-Signature` (deprecated) header +* Check that callback request has `Signature` or `X-Stellar-Signature` (deprecated) header * Parse the header and extract: * Key `t`: __timestamp__ * Key `s`: __base64 signature__ @@ -199,7 +199,7 @@ It is the wallet's responsibility to: * The callback request body * Sign the payload `..` using the Anchor private key * Base64 encode the signature -* Build the `Signature` and `X-Stellar-Signature` (deprecated) header: +* Build the `Signature` or `X-Stellar-Signature` (deprecated) header: * `Signature: t=, s=` * `X-Stellar-Signature: t=, s=` @@ -1414,6 +1414,7 @@ If the information was malformed, or if the sender tried to update data that isn ## Changelog +* `v3.17.1`: Allow anchors to omit the deprecated `X-Stellar-Signature` header ([#1335](https://github.com/stellar/stellar-protocol/pull/1335)) * `v3.17.0`: Deprecate `X-Stellar-Signature` in favor of `Signature` ([#1333](https://github.com/stellar/stellar-protocol/pull/1333)) * `v3.16.0`: Add `refund_memo` and `refund_memo_type` to requests initiating transactions. ([#1321](https://github.com/stellar/stellar-protocol/pull/1321)) * `v3.15.0`: Add `lang` to `/transactions` & `/transaction` parameters, update format to [RFC 4646]. ([#1320](https://github.com/stellar/stellar-protocol/pull/1320)) diff --git a/ecosystem/sep-0012.md b/ecosystem/sep-0012.md index 3284718a3..f7af6d07f 100644 --- a/ecosystem/sep-0012.md +++ b/ecosystem/sep-0012.md @@ -6,8 +6,8 @@ Title: KYC API Author: Interstellar Status: Active Created: 2018-09-11 -Updated: 2023-01-06 -Version 1.11.0 +Updated: 2023-01-10 +Version 1.11.1 ``` ## Abstract @@ -509,7 +509,9 @@ POST [url from PUT request] See [`GET /customer reponse`](#response) for the POST request fields. -In order to validate the integrity and provenance of the request, the Anchor MUST include a signature in the HTTP Header `Signature` and `X-Stellar-Signature` (deprecated). These headers MUST follow the specification: `t=, s=` where: +In order to validate the integrity and provenance of the request, the Anchor MUST include a signature in the HTTP Header `Signature` or `X-Stellar-Signature` (deprecated). Wallets should support both headers until the `X-Stellar-Signature` header is removed from the specification. + +These headers MUST follow the specification: `t=, s=` where: * __timestamp__ is the current Unix timestamp (number of seconds since epoch) at the time the callback is sent. This is used to assure the freshness of the request and to prevent this request to be replayed in the future. * __base64 signature__ is the base64 encoding of the request signature. We explain below how to compute and verify this signature. The signature is computed using the Stellar private key linked to the `SIGNING_KEY` field of the anchor's [`stellar.toml`](sep-0001.md). Note that the timestamp and the Wallet hostname will be part of the signature to prevent replay and relay attacks. @@ -520,7 +522,7 @@ It is the wallet's responsibility to: ### VERIFY signature -* Check that callback request has `Signature` and `X-Stellar-Signature` (deprecated) header +* Check that callback request has `Signature` or `X-Stellar-Signature` (deprecated) header * Parse the header and extract: * Key `t`: __timestamp__ * Key `s`: __base64 signature__ @@ -546,7 +548,7 @@ It is the wallet's responsibility to: * The callback request body * Sign the payload `..` using the Anchor private key * Base64 encode the signature -* Build the `Signature` and `X-Stellar-Signature` (deprecated) header: +* Build the `Signature` or `X-Stellar-Signature` (deprecated) header: * `Signature: t=, s=` * `X-Stellar-Signature: t=, s=` @@ -667,6 +669,7 @@ All responses should return `200 OK`. If no files are found for the identifer us ## Changelog +* `v1.11.1`: Allow anchors to omit the deprecated `X-Stellar-Signature` header ([#1335](https://github.com/stellar/stellar-protocol/pull/1335)) * `v1.11.0`: Deprecate `X-Stellar-Signature` in favor of `Signature` ([#1333](https://github.com/stellar/stellar-protocol/pull/1333)) * `v1.10.0`: Clarify that the `account` and `memo` fields should be inferred from the decoded SEP-10 JWT's `sub` value even when not provided in the request body. * `v1.9.1`: Callback signature: using expected host instead of HTTP Header to validate signature diff --git a/ecosystem/sep-0024.md b/ecosystem/sep-0024.md index eff9b90f6..8289be436 100644 --- a/ecosystem/sep-0024.md +++ b/ecosystem/sep-0024.md @@ -6,8 +6,8 @@ Title: Hosted Deposit and Withdrawal Author: SDF Status: Active Created: 2019-09-18 -Updated: 2023-01-06 -Version 2.9.0 +Updated: 2023-01-10 +Version 2.9.1 ``` ## Simple Summary @@ -91,9 +91,9 @@ This protocol involves the transfer of value, and so HTTPS is required for all e _Note that the signature discussed here is only for **URL callbacks** and does not apply to **`postMessage` callbacks**_ -This protocol involves the optional use of URL callbacks that the Anchor can issue to update the wallet on `status` of a transaction. In order to validate the integrity and provenance of the callback, the Anchor MUST include a signature in the HTTP Header `Signature` and `X-Stellar-Signature` (deprecated). +This protocol involves the optional use of URL callbacks that the Anchor can issue to update the wallet on `status` of a transaction. In order to validate the integrity and provenance of the callback, the Anchor MUST include a signature in the HTTP Header `Signature` or `X-Stellar-Signature` (deprecated). -Anchors and wallets should support both headers until the `X-Stellar-Signature` header is removed for the sake of ecosystem compatibility. +Wallets should support both headers until the `X-Stellar-Signature` header is removed from the specification. These headers MUST follow the specification: `t=, s=` where: * __timestamp__ is the current Unix timestamp (number of seconds since epoch) at the time the callback is sent. This is used to assure the freshness of the request and to prevent this request to be replayed in the future. @@ -106,7 +106,7 @@ It is the wallet's responsibility to: ### VERIFY signature -* Check that callback request has `Signature` and `X-Stellar-Signature` (deprecated) header +* Check that callback request has `Signature` or `X-Stellar-Signature` (deprecated) header * Parse the header and extract: * Key `t`: __timestamp__ * Key `s`: __base64 signature__ @@ -132,7 +132,7 @@ It is the wallet's responsibility to: * The callback request body * Sign the payload `..` using the Anchor private key * Base64 encode the signature -* Build the `Signature` and `X-Stellar-Signature` (deprecated) header: +* Build the `Signature` or `X-Stellar-Signature` (deprecated) header: * `Signature: t=, s=` * `X-Stellar-Signature: t=, s=` @@ -1021,6 +1021,7 @@ There is a small set of changes when upgrading from SEP-6 to SEP-24. ## Changelog +* `v2.9.1`: Allow anchors to omit the deprecated `X-Stellar-Signature` header ([#1335](https://github.com/stellar/stellar-protocol/pull/1335)) * `v2.9.0`: Deprecate `X-Stellar-Signature` in favor of `Signature` ([#1333](https://github.com/stellar/stellar-protocol/pull/1333)) * `v2.8.0`: Add `updated_at` to transaction records. ([#1329](https://github.com/stellar/stellar-protocol/pull/1329)) * `v2.7.0`: Add `refund_memo` and `refund_memo_type` parameters to withdraw endpoint. ([#1321](https://github.com/stellar/stellar-protocol/pull/1321)) diff --git a/ecosystem/sep-0031.md b/ecosystem/sep-0031.md index 8a657bfa9..fc850d46c 100644 --- a/ecosystem/sep-0031.md +++ b/ecosystem/sep-0031.md @@ -6,8 +6,8 @@ Title: Cross-Border Payments API Author: SDF Status: Active Created: 2020-04-07 -Updated: 2023-01-06 -Version 2.3.0 +Updated: 2023-01-10 +Version 2.3.1 ``` ## Simple Summary @@ -846,7 +846,9 @@ POST [url from PUT request] See the response to [`GET /transaction/:id`](#get-transaction) for the POST request fields. -In order to validate the integrity and provenance of the request, the Receiving Anchor MUST include a signature in the HTTP Header `Signature` and `X-Stellar-Signature` (deprecated). These headers MUST follow the specification: `t=, s=` where: +In order to validate the integrity and provenance of the request, the Receiving Anchor MUST include a signature in the HTTP Header `Signature` or `X-Stellar-Signature` (deprecated). Sending Anchors should support both headers until the `X-Stellar-Signature` header is removed from the specification. + +These headers MUST follow the specification: `t=, s=` where: * __timestamp__ is the current Unix timestamp (number of seconds since epoch) at the time the callback is sent. This is used to assure the freshness of the request and to prevent this request to be replayed in the future. * __base64 signature__ is the base64 encoding of the request signature. We explain below how to compute and verify this signature. The signature is computed using the Stellar private key linked to the `SIGNING_KEY` field of the Receiving Anchor's [`stellar.toml`](sep-0001.md). Note that the timestamp and the Sending Anchor hostname will be part of the signature to prevent replay and relay attacks. @@ -857,7 +859,7 @@ It is the Sending Anchor's responsibility to: ### VERIFY signature -* Check that callback request has `Signature` and `X-Stellar-Signature` (deprecated) header +* Check that callback request has `Signature` or `X-Stellar-Signature` (deprecated) header * Parse the header and extract: * Key `t`: __timestamp__ * Key `s`: __base64 signature__ @@ -883,7 +885,7 @@ It is the Sending Anchor's responsibility to: * The callback request body * Sign the payload `..` using the Receiving Anchor private key * Base64 encode the signature -* Build the `Signature` and `X-Stellar-Signature` (deprecated) header: +* Build the `Signature` or `X-Stellar-Signature` (deprecated) header: * `Signature: t=, s=` * `X-Stellar-Signature : t=, s=` @@ -897,6 +899,7 @@ It is important to note that the Receiving Anchor is not obligated, at least by ## Changelog +* `v2.3.1`: Allow anchors to omit the deprecated `X-Stellar-Signature` header ([#1335](https://github.com/stellar/stellar-protocol/pull/1335)) * `v2.3.0`: Deprecate `X-Stellar-Signature` in favor of `Signature` ([#1333](https://github.com/stellar/stellar-protocol/pull/1333)) * `v2.2.0`: Add `refund_memo` & `refund_memo_type` to `POST /transactions` request. ([#1321](https://github.com/stellar/stellar-protocol/pull/1321)) * `v2.1.0`: Add the `refunded` status and updated the Detailed Receiving Anchor Flow. ([#1311](https://github.com/stellar/stellar-protocol/pull/1311))