wfgilman

wfgilman

I’m writing a Plug which verifies a signature in the header of a request. The signature is the SHA256 HMAC hash of the request body signed with a secret. I’m having trouble testing this because I don’t know how to put the request body in the %Conn{} to run it through the plug. Setting up the headers are easy with put_req_header/3. Is there an equivalent for setting the body?

I’m trying to setup my connection like this in my test:

setup %{conn: conn} do
  body = %{"some" => "message"}
  signature = Plug.Crypto.MessageVerifier.sign(Poison.encode!(body), "s3cret", :sha256)
  conn =
    conn
    |> put_req_header("accept", "application/json")
    |> put_req_header("content-type", "application/json")
    |> put_req_header("x-request-signature", signature)
    |> put_request_body???
  {:ok, conn: conn}
end

Showing Posts 1 to 4

idi527

idi527

Would something like this conn = %{conn | body_params: body} work for you?

setup %{conn: conn} do
  body_params = %{"some" => "message"}
  signature =
    body_params
    |> Poison.encode!()
    |> Plug.Crypto.MessageVerifier.sign("s3cret", :sha256)
  conn =
    conn
    |> put_req_header("accept", "application/json")
    |> put_req_header("content-type", "application/json")
    |> put_req_header("x-request-signature", signature)
    |> put_body_params(body_params)
  {:ok, conn: conn}
end

defp put_body_params(conn, body_params) do
  %{conn | body_params: body_params}
end

Or as a workaround you might put your body in conn.private.

wfgilman

wfgilman OP

I can see that working for a test. I think part of my problem is I got off track when Plug.Conn.read_body/2 returned nothing. This isn’t due to setting the body incorrectly, however. It’s part of this long issue where the request body can only be read once - and that happens when Plug.Parsers is called.

https://github.com/phoenixframework/phoenix/issues/459

I will try to resolve read_body/2 and then try your suggestion. Thanks!

wfgilman

wfgilman OP

This ended up being the solution to my problem: How to: Plug which verifies header signature signed using request body

flash4syth

flash4syth

I tried to use this solution to populate a %Plug.Conn{}'s body_params key; however, the conn.body_params was set to %{} after calling conn = post(conn, "/path") in my test. However, when I simply wrote it thus:

post(conn, “/path”, %{“my_params” => “param_val”, …})

Then it worked like a charm–conn.body_params was populated.

— All posts loaded —

Where Next? Top

Trending in Questions Top

Blokh
Hey guys, I’ve got a huge CSV ( around 10 GB ) that needs to be processed hourly Do you guys have any suggestions what is the best prac...
New
kszambelanczyk
Hello! Could someone please give me a help/sample code, how to delete a file from s3 using waffle/waffle_ecto from Phoenix app. I creat...
New
Onor.io
I have what I’ve heard referred to as a “lookup table” in my database. This is a way of assigning codes to common values. One common lo...
New
Trolleger
What approach to take when sending live updates to “random” users Hi! I have a question, I have a little chat app, and when I create a DM...
New
RemyXRenard
I’m seeing that a list inside a Kino.DataTable will be interpreted as a charlist, even if the Kino.configure() is set to charlists: :as_l...
New
matt-savvy
Anyone here using Honeybadger? My Honeybadger account is being overwhelmed with noise from some bots. Seeing a lot of Bandit.HTTPError...
New
samoloth
Hi, I’ve just set up an application with ash_authentication. There is only magic link strategy for now, so there is no confirmation add o...
New

Other Trending Topics Top

mudasobwa
I am happy to introduce the very α version of the new programming language compiled to BEAM. Welcome Cure. It has literally three kille...
New
garrison
Hobbes is a low-level distributed database for the Elixir programming language. Hobbes provides a simple, safe, and scalable storage lay...
New
mcass19
ExRatatui lets you cook up rich terminal UIs in Elixir, powered by Rust’s ratatui via Rustler NIFs. Build interactive terminal applicatio...
New
Damirados
Hello everyone. After busy few months I am happy to announce v0.1.0 of Emerge & Solve. They are GUI (Emerge) and State management (S...
New
netoum
Corex is an accessible, unstyled UI component library for Phoenix that integrates Zag.js state machines using Vanilla JavaScript and Live...
New
wintermeyer
There are three potential reasons for members of this forum to have a look at https://vutuv.de You are tired or annoyed of LinkedIn. Yo...
New

We're in Beta

About us Mission Statement

Options

Thread Display Mode




Thread Preview

Skip Thread Previews