Forward Autograph Confirmation with airSlate SignNow

Forward autograph confirmation

hi and welcome to this video where we look at how to implement signature verification to authenticate web books we begin by looking at a common vulnerability with web books which allows any client to send requests to a web book url this vulnerability is what we'll be fixing by authenticating our web url using signature verification we'll start by setting up a web book on shopify this web book comes with a secret that shopify will use to sign our web books on our server we will then implement the signature verification check by computing the web book signature and comparing it to the one sent by shopify we then try to send a request from an unauthorized client and see how the verification process blocks that request we also trigger an actual shopify workbook and as expected it passes the authentication check confirming that our web book url is now protected from unwanted requests finally we demonstrate how signature verification prevents man-in-the-middle attacks by trying to send a compromised payload using a verified signature ready to begin let's get right into it so in this video we're going to be implementing signature verification on shopify web books to begin i have a node server running here at port 1337 i already have a webhook url generated by the hookdexcli that points to one of my routes here this log web route that logs a subset of the payload of the shopify web book and uh another url or another endpoint where i can fetch the logged web book data now this web url that i've generated using the udex cli is meant for a shopify workbook but if i copy it and go into postman put it in the address bar now this is a payload a simple payload that simulates a malicious payload you see we have evil dangerous compromising and some sort of view binary here so if i send this request and by the way this request also has the hmac shopify header that i just set to a random figure if i send this request i get a success from ubdeck as usual because ugdeck will definitely acknowledge this web book when i go to my cli i see that this workbook is also acknowledged by the server the server is returning this tool one meaning that it logged this malicious web book if i go to the event page we see that this web book is successfully logged as you can see here i scroll down and click on attempt you see workbook successfully logged and if i go to the endpoint that fetches my workbook that's the fetch workbook logs endpoint you can see that the malicious data is now inside my database now we don't want that we need a way to restrict this web book url this web book url that would generate for us we need to be able to restrict this web book url to only receive web...