API Request Signing: Pitfalls and Best Practices
This article delves into the security challenges of API request signing, particularly the difficulties of signing JSON objects. The author points out that while simple HMAC signing is secure, signing directly within the JSON object can lead to various issues, such as multiple equivalent representations of JSON resulting in signature validation failures. The article compares and analyzes various signing methods, including canonicalizing JSON, adding redundant signature data, and using alternative formats. Examples from AWS and Flickr's signing schemes illustrate the security risks of flawed implementations. Ultimately, the author recommends prioritizing TLS and avoiding inline JSON signing, opting instead for external signing to ensure API request security.