alexa_request_verifier v0.1.6 AlexaRequestVerifier

AlexaRequestVerifier verifies an Amazon Alexa Skills request to a Pheonix server.

To add the request, you will need to make 4 changes:

1. mix.exs - the package can be installed by adding `alexa_request_verifier` to your list of dependencies in `mix.exs`:


    def deps do
      [{:alexa_request_verifier, "~> 0.1.3"}]
    end

2. You will need to add AlexaRequestVerifier as an application in your mix.js


      applications: [..., :alexa_request_verifier]


3.  You will need to modify your endpoint.ex file by adding the JSONRawBody Parser as follows:

      parsers: [AlexaRequestVerifier.JSONRawBodyParser, :urlencoded, :multipart, :json],

The parser is needed to collect the raw body of the request as that is needed to verify the signature.

4. You will need to add the verifier plug to your pipeline in your router.ex file

  pipeline :alexa_api do
      plug :accepts, ["json"]
      plug AlexaRequestVerifier
  end

Link to this section Summary

Functions

takes a string and confirms URL is in scheme https, has a s3.amazonaws.com host, is port 443 and has a path starting with /echo.api/

Validates the cert checks for hostname, checks that the cert has a valid key, etc… loop through the configured root CA’s

Assuming :raw_body, :signing_cert, and signature header, it will verify the signature

given a Plug.Conn that has a valid Alexa request request/timestamp, it will confirm the timestamp is valid

Link to this section Functions

Link to this function call(conn, opts)
Link to this function fetch_cert(url)
Link to this function get_validated_cert(conn)
Link to this function is_correct_alexa_url?(url)

takes a string and confirms URL is in scheme https, has a s3.amazonaws.com host, is port 443 and has a path starting with /echo.api/

Link to this function is_datetime_valid?(datetime_string)
Link to this function validate_cert(err)
Link to this function validate_cert_by_binary(root_cert_bin, cert)
Link to this function validate_cert_chain(cert)

Validates the cert checks for hostname, checks that the cert has a valid key, etc… loop through the configured root CA’s

Link to this function validate_cert_domain(error)
Link to this function verify_fun(arg1, arg2, state)
Link to this function verify_signature(conn)

Assuming :raw_body, :signing_cert, and signature header, it will verify the signature

Link to this function verify_signature_with_valid_cert(conn)
Link to this function verify_time(conn)

given a Plug.Conn that has a valid Alexa request request/timestamp, it will confirm the timestamp is valid