We have a proxy that needs to be secured by a ECDSA digital signature. Are there any policies that can verify the signature using a public key? Or, will we need to verify this in Java, Python, or other code?
Here's the security guidance.
Security: Digital Signature
Type: Public/Private Key
Header: The x-webhook-signature header includes a digital signature header signed by the webhook provider
Digital Signature Algorithm: Elliptical Curve Digital Signature Algorithm
Hash: SHA256
Header Example: x-webhook-signature:86-6D-59-BE-8A-...E9-B0-49-F6-39-95
Example cURL:
curl -X POST
https://xyz.com/endpoint1
-H 'Accept: */*'
-H 'Accept-Encoding: gzip, deflate'
-H 'Content-Type: application/json'
-H 'x-webhook-signature: 86-6D-59-BE-8A-E9-B0-49-F6-39-9'
-d '{"application":"data"}'
LinkedIn
Twitter
