Hmac Based Authentication

parts = [
    "TPV1",
    self.key,
    nonce,
    timestamp,
    method,
    host,
    path,
    query,
    content_type
]
parts = [p for p in parts if p and p != ""] // omit empty parts
msg = bytes(' '.join(parts), 'utf-8') // separate by space
if body: 
    msg += bytes(' ','utf-8') // add a space and generate a byte sequence from the body
    msg += bytes(body, 'utf-8') 

signatureBytes = hmac.new(
  bytes.fromhex(self.secret),
  msg = msg,
  digestmod = hashlib.sha256
).digest()

signature = base64.b64encode(signatureBytes).decode('ascii')

auth_header = 'TPV1-HMAC-SHA256 ApiKey={} Nonce={} Timestamp={} Signature={}'.format(self.key, nonce, timestamp, signature)
req.headers['Authorization'] = auth_header

"""
HMAC Authentication Proxy Server

This proxy server listens on a specified local port and forwards all requests
to the configured URL, while adding an authorization header based on the
supplied API key.

Usage example:
    python hmac_auth_proxy.py --port 9000 --destination https://example.com --key your-api-key --secret your-api-secret

This implementation uses Flask and requests for handling HTTP operations more robustly.

requirements.txt:

flask==2.3.3
cryptography==41.0.4
Werkzeug==2.3.7
requests==2.31.0 
"""

import argparse
import base64
import hashlib
import hmac
import time
import uuid
from urllib.parse import urlparse, urlunparse

import requests
from flask import Flask, request, Response, stream_with_context


class HmacAuthProxy:
    def __init__(self, destination, api_key, api_secret):
        self.destination = destination.rstrip('/')
        self.api_key = api_key
        self.api_secret = bytes.fromhex(api_secret)
        self.app = Flask(__name__)
        self._setup_routes()

    def _setup_routes(self):
        @self.app.route('/', defaults={'path': ''}, methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH'])
        @self.app.route('/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH'])
        def proxy(path):

            url_parts = urlparse(f"{self.destination}/{path}")
            
            method = request.method
            query = request.query_string.decode('utf-8') if request.query_string else ""
            
            content_type = request.headers.get('Content-Type', '')
            body = request.get_data() if request.data else None
            
            # Create a new headers dictionary from the original request
            headers = dict(request.headers)
            
            # Update host in headers
            headers['Host'] = url_parts.netloc
            
            # Generate and set authorization header
            headers['Authorization'] = self._generate_auth_header(
                method, 
                url_parts.netloc, 
                url_parts.path, 
                query, 
                content_type, 
                body
            )
            
            headers.pop('Content-Length', None)
            headers.pop('Content-Encoding', None)
            headers.pop('Transfer-Encoding', None)
            
            # Build the target URL
            target_url = urlunparse((
                url_parts.scheme,
                url_parts.netloc,
                url_parts.path,
                url_parts.params,
                query,
                url_parts.fragment
            ))
            
            # Make the request to the target URL
            resp = requests.request(
                method=method,
                url=target_url,
                headers=headers,
                data=body,
                stream=True
            )
            
            # Create a Flask response object from the requests response
            response = Response(
                stream_with_context(resp.iter_content(chunk_size=1024)),
                status=resp.status_code,
                content_type=resp.headers.get('Content-Type')
            )
            
            # Copy response headers to the Flask response
            for key, value in resp.headers.items():
                if key.lower() not in ('content-length', 'content-encoding', 'transfer-encoding'):
                    response.headers[key] = value
            
            return response

    def _generate_auth_header(self, method, host, path, query, content_type, body):
        nonce = str(uuid.uuid4())
        timestamp = str(int(time.time() * 1000))
        
        parts = [
            "TPV1",
            self.api_key,
            nonce,
            timestamp,
            method,
            host,
            path,
            query,
            content_type
        ]
        
        # Remove any empty parts
        parts = [p for p in parts if p and p != ""]
        
        # Join the parts with spaces
        message = ' '.join(parts).encode('utf-8')
        
        # If there's a body, append it to the message
        if body:
            message = message + b' ' + body
        
        # Create HMAC-SHA256 signature
        signature_bytes = hmac.new(self.api_secret, msg=message, digestmod=hashlib.sha256).digest()
        signature = base64.b64encode(signature_bytes).decode('ascii')
        
        return f'TPV1-HMAC-SHA256 ApiKey={self.api_key} Nonce={nonce} Timestamp={timestamp} Signature={signature}'

    def run(self, port=9000):
        print(f"Starting proxy on port {port} redirecting to {self.destination} ...")
        self.app.run(host='0.0.0.0', port=port)


def main():
    # Parse command line arguments
    parser = argparse.ArgumentParser(description='HMAC Authentication Proxy')
    parser.add_argument('-p', '--port', type=int, default=9000, help='Local port to listen on')
    parser.add_argument('-d', '--destination', required=True, help='Destination host to forward to')
    parser.add_argument('-k', '--key', required=True, help='API key ID')
    parser.add_argument('-s', '--secret', required=True, help='API key secret (hex-encoded)')
    args = parser.parse_args()
    
    # Create and run the proxy
    proxy = HmacAuthProxy(args.destination, args.key, args.secret)
    proxy.run(args.port)


if __name__ == '__main__':
    main() 

package com.taurussigner.hmac;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.web.server.ConfigurableWebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.*;
import java.net.HttpURLConnection;
import java.net.URI;
import java.net.URL;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Base64;
import java.util.Enumeration;
import java.util.List;
import java.util.UUID;
import java.util.concurrent.TimeUnit;

/**
 * HMAC Authentication Proxy Server
 * 
 * This proxy server listens on a specified local port and forwards all requests
 * to the configured URL, while adding an authorization header based on the
 * supplied API key.
 */
@SpringBootApplication
public class HmacAuthProxy {

    private final String destination;
    private final String apiKey;
    private final byte[] apiSecret;

    public HmacAuthProxy(String destination, String apiKey, String apiSecret) {
        this.destination = destination.endsWith("/") ? destination.substring(0, destination.length() - 1) : destination;
        this.apiKey = apiKey;
        this.apiSecret = hexStringToByteArray(apiSecret);
    }

    private static byte[] hexStringToByteArray(String s) {
        int len = s.length();
        byte[] data = new byte[len / 2];
        for (int i = 0; i < len; i += 2) {
            data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4)
                    + Character.digit(s.charAt(i + 1), 16));
        }
        return data;
    }

    public void start(int port) {
        System.setProperty("proxy.destination", destination);
        System.setProperty("proxy.apiKey", apiKey);
        System.setProperty("proxy.apiSecret", Base64.getEncoder().encodeToString(apiSecret));
        System.setProperty("server.port", String.valueOf(port));
        
        SpringApplication.run(HmacAuthProxy.class);
        System.out.println("Starting proxy on port " + port + " redirecting to " + destination + " ...");
    }

    @Component
    public static class ServerPortCustomizer implements WebServerFactoryCustomizer<ConfigurableWebServerFactory> {
        @Override
        public void customize(ConfigurableWebServerFactory factory) {
            factory.setPort(Integer.parseInt(System.getProperty("server.port", "9000")));
        }
    }

    @Component
    public static class ProxyFilter extends OncePerRequestFilter {

        private final String destination;
        private final String apiKey;
        private final byte[] apiSecret;

        public ProxyFilter() {
            this.destination = System.getProperty("proxy.destination");
            this.apiKey = System.getProperty("proxy.apiKey");
            this.apiSecret = Base64.getDecoder().decode(System.getProperty("proxy.apiSecret"));
        }

        @Override
        protected void doFilterInternal(
                HttpServletRequest request,
                HttpServletResponse response,
                FilterChain filterChain) throws ServletException, IOException {

            // Get request details
            String method = request.getMethod();
            String path = request.getRequestURI();
            String query = request.getQueryString() != null ? request.getQueryString() : "";
            String contentType = request.getContentType() != null ? request.getContentType() : "";

            // Read request body if present
            byte[] body = readRequestBody(request);

            // Create destination URL
            URL url = new URI(destination + path + (query.isEmpty() ? "" : "?" + query)).toURL();
            HttpURLConnection connection = (HttpURLConnection) url.openConnection();
            connection.setRequestMethod(method);

            // Copy headers from original request
            Enumeration<String> headerNames = request.getHeaderNames();
            while (headerNames.hasMoreElements()) {
                String headerName = headerNames.nextElement();
                String headerValue = request.getHeader(headerName);
                if (!headerName.equalsIgnoreCase("host")) {
                    connection.setRequestProperty(headerName, headerValue);
                }
            }

            // Add Host header
            connection.setRequestProperty("Host", url.getHost());

            try {
                // Add authorization header
                String authHeader = generateAuthHeader(
                        method,
                        url.getHost(),
                        url.getPath(),
                        query,
                        contentType,
                        body
                );
                connection.setRequestProperty("Authorization", authHeader);

                // Set up for output if needed
                if (body.length > 0) {
                    connection.setDoOutput(true);
                    try (OutputStream os = connection.getOutputStream()) {
                        os.write(body);
                    }
                }

                // Get response
                int statusCode = connection.getResponseCode();
                response.setStatus(statusCode);

                // Copy response headers
                for (String headerName : connection.getHeaderFields().keySet()) {
                    if (headerName != null && 
                        !headerName.equalsIgnoreCase("Transfer-Encoding") && 
                        !headerName.equalsIgnoreCase("Content-Length")) {
                        String headerValue = connection.getHeaderField(headerName);
                        response.setHeader(headerName, headerValue);
                    }
                }

                // Copy response body
                try (InputStream is = statusCode >= 400 ? connection.getErrorStream() : connection.getInputStream()) {
                    if (is != null) {
                        try (OutputStream os = response.getOutputStream()) {
                            byte[] buffer = new byte[4096];
                            int bytesRead;
                            while ((bytesRead = is.read(buffer)) != -1) {
                                os.write(buffer, 0, bytesRead);
                            }
                        }
                    }
                }

            } catch (Exception e) {
                e.printStackTrace();
                response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
                response.getWriter().write("Error proxying request: " + e.getMessage());
            }
        }

        private byte[] readRequestBody(HttpServletRequest request) throws IOException {
            try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
                if (request.getContentLength() > 0) {
                    try (InputStream is = request.getInputStream()) {
                        byte[] buffer = new byte[4096];
                        int bytesRead;
                        while ((bytesRead = is.read(buffer)) != -1) {
                            baos.write(buffer, 0, bytesRead);
                        }
                    }
                }
                return baos.toByteArray();
            }
        }

        private String generateAuthHeader(String method, String host, String path, String query, String contentType, byte[] body) 
                throws NoSuchAlgorithmException, InvalidKeyException, IOException {
            
            String nonce = UUID.randomUUID().toString();
            String timestamp = String.valueOf(Instant.now().toEpochMilli());

            List<String> parts = new ArrayList<>();
            parts.add("TPV1");
            parts.add(apiKey);
            parts.add(nonce);
            parts.add(timestamp);
            parts.add(method);
            parts.add(host);
            parts.add(path);
            parts.add(query);
            parts.add(contentType);

            // Remove any empty parts
            parts.removeIf(String::isEmpty);
            String message = String.join(" ", parts);
            
            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
            outputStream.write(message.getBytes(StandardCharsets.UTF_8));
            
            // If there's a body, append it to the message
            if (body.length > 0) {
                outputStream.write(' ');
                outputStream.write(body);
            }
            
            byte[] messageBytes = outputStream.toByteArray();

            // Create HMAC-SHA256 signature
            Mac hmac = Mac.getInstance("HmacSHA256");
            SecretKeySpec keySpec = new SecretKeySpec(apiSecret, "HmacSHA256");
            hmac.init(keySpec);
            byte[] signatureBytes = hmac.doFinal(messageBytes);
            String signature = Base64.getEncoder().encodeToString(signatureBytes);

            return String.format("TPV1-HMAC-SHA256 ApiKey=%s Nonce=%s Timestamp=%s Signature=%s", apiKey, nonce, timestamp, signature);
        }
    }
    
    public static void main(String[] args) {
        if (args.length < 6) {
            System.out.println("Usage: java -jar hmac-auth-proxy.jar --port <port> --destination <destination> --key <apiKey> --secret <apiSecret>");
            return;
        }

        int port = 9000;
        String destination = null;
        String apiKey = null;
        String apiSecret = null;

        for (int i = 0; i < args.length; i++) {
            switch (args[i]) {
                case "--port":
                case "-p":
                    if (i + 1 < args.length) {
                        try {
                            port = Integer.parseInt(args[++i]);
                        } catch (NumberFormatException e) {
                            System.err.println("Error: port must be a number");
                            return;
                        }
                    }
                    break;
                case "--destination":
                case "-d":
                    if (i + 1 < args.length) {
                        destination = args[++i];
                    }
                    break;
                case "--key":
                case "-k":
                    if (i + 1 < args.length) {
                        apiKey = args[++i];
                    }
                    break;
                case "--secret":
                case "-s":
                    if (i + 1 < args.length) {
                        apiSecret = args[++i];
                    }
                    break;
            }
        }

        if (destination == null || apiKey == null || apiSecret == null) {
            System.err.println("Error: destination, key, and secret are required arguments");
            return;
        }

        HmacAuthProxy proxy = new HmacAuthProxy(destination, apiKey, apiSecret);
        proxy.start(port);
    }
} 

using System;
using System.Collections.Generic;
using System.IO;
using System.Net;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;

namespace TaurusSigner.HmacAuth
{
    /// <summary>
    /// HMAC Authentication Proxy Server
    /// 
    /// This proxy server listens on a specified local port and forwards all requests
    /// to the configured URL, while adding an authorization header based on the
    /// supplied API key.
    /// </summary>
    public class HmacAuthProxy
    {
        private readonly string _destination;
        private readonly string _apiKey;
        private readonly string _apiSecret;
        private readonly HttpClient _httpClient;

        public HmacAuthProxy(string destination, string apiKey, string apiSecret)
        {
            _destination = destination.TrimEnd('/');
            _apiKey = apiKey;
            _apiSecret = apiSecret;
            _httpClient = new HttpClient();
        }

        public void Start(int port)
        {
            var builder = WebApplication.CreateBuilder();
            var app = builder.Build();

            app.UseMiddleware<ProxyMiddleware>(this);

            Console.WriteLine($"Starting proxy on port {port} redirecting to {_destination}...");
            app.Run($"http://localhost:{port}");
        }

        private string GenerateAuthHeader(string method, string host, string path, string query, string contentType, byte[] body)
        {
            var nonce = Guid.NewGuid().ToString();
            var timestamp = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds().ToString();

            var parts = new List<string>
            {
                "TPV1",
                _apiKey,
                nonce,
                timestamp,
                method,
                host,
                path,
                query,
                contentType
            };

            // Remove any empty parts
            parts.RemoveAll(string.IsNullOrEmpty);
            var message = string.Join(" ", parts);

            using var hmac = new HMACSHA256(Convert.FromHexString(_apiSecret));
            
            var messageBytes = Encoding.UTF8.GetBytes(message);
            
            // If there's a body, append it to the message
            if (body != null && body.Length > 0)
            {
                using var ms = new MemoryStream();
                ms.Write(messageBytes, 0, messageBytes.Length);
                ms.Write(new byte[] { (byte)' ' }, 0, 1);
                ms.Write(body, 0, body.Length);
                messageBytes = ms.ToArray();
            }

            var signatureBytes = hmac.ComputeHash(messageBytes);
            var signature = Convert.ToBase64String(signatureBytes);

            return $"TPV1-HMAC-SHA256 ApiKey={_apiKey} Nonce={nonce} Timestamp={timestamp} Signature={signature}";
        }

        private class ProxyMiddleware
        {
            private readonly RequestDelegate _next;
            private readonly HmacAuthProxy _proxy;

            public ProxyMiddleware(RequestDelegate next, HmacAuthProxy proxy)
            {
                _next = next;
                _proxy = proxy;
            }

            public async Task InvokeAsync(HttpContext context)
            {
                var method = context.Request.Method;
                var path = context.Request.Path.ToString();
                var query = context.Request.QueryString.ToString();
                var contentType = context.Request.ContentType ?? string.Empty;

                // Read the request body
                byte[] body = null;
                if (context.Request.ContentLength > 0)
                {
                    using var ms = new MemoryStream();
                    await context.Request.Body.CopyToAsync(ms);
                    body = ms.ToArray();
                    context.Request.Body = new MemoryStream(body);
                }

                // Create a new HttpRequestMessage for the destination
                var requestUri = new Uri($"{_proxy._destination}{path}{query}");
                var request = new HttpRequestMessage(new HttpMethod(method), requestUri);

                // Copy headers from original request
                foreach (var header in context.Request.Headers)
                {
                    if (!request.Headers.TryAddWithoutValidation(header.Key, header.Value.ToArray()) && request.Content != null)
                    {
                        request.Content.Headers.TryAddWithoutValidation(header.Key, header.Value.ToArray());
                    }
                }

                // Add the authorization header
                var authHeader = _proxy.GenerateAuthHeader(
                    method,
                    requestUri.Host,
                    requestUri.AbsolutePath,
                    query.TrimStart('?'),
                    contentType,
                    body
                );
                request.Headers.TryAddWithoutValidation("Authorization", authHeader);

                // Add content if needed
                if (body != null && body.Length > 0)
                {
                    request.Content = new ByteArrayContent(body);
                    if (!string.IsNullOrEmpty(contentType))
                    {
                        request.Content.Headers.Remove("Content-Type");
                        request.Content.Headers.TryAddWithoutValidation("Content-Type", contentType);
                    }
                }

                // Send the request to the destination
                var response = await _proxy._httpClient.SendAsync(request);

                // Copy status code
                context.Response.StatusCode = (int)response.StatusCode;

                // Copy response headers
                foreach (var header in response.Headers)
                {
                    context.Response.Headers[header.Key] = header.Value.ToArray();
                }

                if (response.Content != null)
                {
                    foreach (var header in response.Content.Headers)
                    {
                        if (!header.Key.Equals("Content-Length", StringComparison.OrdinalIgnoreCase))
                        {
                            context.Response.Headers[header.Key] = header.Value.ToArray();
                        }
                    }

                    // Copy response body
                    await response.Content.CopyToAsync(context.Response.Body);
                }
            }
        }
    }

    public class Program
    {
        public static void Main(string[] args)
        {
            if (args.Length < 6)
            {
                Console.WriteLine("Usage: dotnet run --port <port> --destination <destination> --key <apiKey> --secret <apiSecret>");
                return;
            }

            int port = 9000;
            string destination = null;
            string apiKey = null;
            string apiSecret = null;

            for (int i = 0; i < args.Length; i++)
            {
                switch (args[i])
                {
                    case "--port":
                    case "-p":
                        if (i + 1 < args.Length && int.TryParse(args[i + 1], out int p))
                        {
                            port = p;
                            i++;
                        }
                        break;
                    case "--destination":
                    case "-d":
                        if (i + 1 < args.Length)
                        {
                            destination = args[i + 1];
                            i++;
                        }
                        break;
                    case "--key":
                    case "-k":
                        if (i + 1 < args.Length)
                        {
                            apiKey = args[i + 1];
                            i++;
                        }
                        break;
                    case "--secret":
                    case "-s":
                        if (i + 1 < args.Length)
                        {
                            apiSecret = args[i + 1];
                            i++;
                        }
                        break;
                }
            }

            if (string.IsNullOrEmpty(destination) || string.IsNullOrEmpty(apiKey) || string.IsNullOrEmpty(apiSecret))
            {
                Console.WriteLine("Error: destination, key, and secret are required arguments");
                return;
            }

            var proxy = new HmacAuthProxy(destination, apiKey, apiSecret);
            proxy.Start(port);
        }
    }
} 

var url = require('url');
var uuid = require('uuid');
var CryptoJS = require('crypto-js')
var { Property } = require('postman-collection');

var apiKey = await pm.vault.get("apiKey");
var apiSecret = await pm.vault.get("apiSecret");

const authorizationScheme = 'TPV1-HMAC-SHA256';

function computeHmac(message, key_hex) {
    enc = CryptoJS.HmacSHA256(message, CryptoJS.enc.Hex.parse(key_hex));
    return CryptoJS.enc.Base64.stringify(enc);
}

function newNonce() {
    return uuid.v4();
}

function calculateAuthHeader(req) {
    let urlExpanded = Property.replaceSubstitutions(req.url.toString(), pm.variables.toObject());
    let parsedUrl = url.parse(urlExpanded);
    let hostname = parsedUrl.hostname;
    let port = parsedUrl.port;
    if ((port !== "") && (port !== null) && (port !== undefined)) {
        hostname = hostname + ":" + port;
    }
    let path = parsedUrl.pathname;
    let queryString = parsedUrl.query;
    let method = req.method;
    let dateStamp = Date.now().toString();
    let nonce = newNonce();
    let body = req.body.toString();
    let contentType = ''
    if (method === "POST" || method === "PUT") {
        contentType = 'application/json';
    }

    items = [
        "TPV1",
        apiKey,
        nonce,
        dateStamp,
        method,
        hostname,
        path,
        queryString,
        contentType,
        body,
    ];
    
    let payload = "";
    for (item of items) {
         if ((item !== "") && (item !== undefined) && (item !== null)) {
            if (payload.length > 0) {
                payload = payload + " ";    
            }
            payload = payload + item;
        }
    }

    sig = computeHmac(payload, apiSecret);
    return `${authorizationScheme} ApiKey=${apiKey} Nonce=${nonce} Timestamp=${dateStamp} Signature=${sig}`;
}

pm.request.headers.add({
    key: 'Authorization',
    value: calculateAuthHeader(pm.request)
});