alexa_request_verifier v0.1.1 AlexaRequestVerifier

AlexaRequestVerifier verifies an Amazon Alexa Skills request to a Pheonix server.

To add the request, you will need to make 4 changes:

  1. mix.exs - the package can be installed by adding alexa_request_verifier to your list of dependencies in mix.exs:

    def deps do [{:alexa_request_verifier, “~> 0.1.1”}] end

  2. You will need to add AlexaRequestVerifier as an application in your mix.js

    applications: […, :alexa_request_verifier]

  3. You will need to modify your endpoint.ex file by adding the JSONRawBody Parser as follows:

    parsers: [AlexaRequestVerifier.JSONRawBodyParser, :urlencoded, :multipart, :json],

The parser is needed to collect the raw body of the request as that is needed to verify the signature.

  1. You will need to add the verifier plug to your pipeline in your router.ex file

pipeline :alexa_api do

plug :accepts, ["json"]
plug AlexaRequestVerifier

end

Summary

Functions

takes a string and confirms URL is in scheme https, has a s3.amazonaws.com host, is port 443 and has a path starting with /echo.api/

Validates the cert checks for hostname, checks that the cert has a valid key, etc

Assuming :raw_body, :signing_cert, and signature header, it will verify the signature

given a Plug.Conn that has a valid Alexa request request/timestamp, it will confirm the timestamp is valid

Functions

call(conn, opts)
fetch_cert(url)
get_validated_cert(conn)
init(opts)
is_correct_alexa_url?(url)

takes a string and confirms URL is in scheme https, has a s3.amazonaws.com host, is port 443 and has a path starting with /echo.api/

is_datetime_valid?(datetime_string)
validate_cert(cert)
validate_cert_chain(cert)

Validates the cert checks for hostname, checks that the cert has a valid key, etc…

validate_cert_domain(arg)
verify_fun(arg1, arg2, state)
verify_signature(conn)

Assuming :raw_body, :signing_cert, and signature header, it will verify the signature

verify_time(conn)

given a Plug.Conn that has a valid Alexa request request/timestamp, it will confirm the timestamp is valid