feat(security): enforce HTTP request signature validation by evebrnd · Pull Request #185 · Decathlon/internal-developer-platform

evebrnd · 2026-11-05T16:14:32Z

PR Description

What this PR Provides

Verify signed HTTP requests from any client
Support the Signature header with HMAC-SHA256, SHA1, SHA384, or SHA512.
Configure the shared secret, identifier header, maximum lifetime, clock skew, and exclusions under app.security.http-message-signature.
Enforce verification before authentication across API and webhook security chains.

Review

The reviewer must double-check these points:

The reviewer has tested the feature
The reviewer has reviewed the implementation of the feature
The documentation has been updated
The feature implementation respects the Technical Doc / ADR previously produced

How to test

Initial state

Enable HTTP_MESSAGE_SIGNATURE_ENABLED and provide HTTP_MESSAGE_SIGNATURE_SECRET, then restart the application. The default signed identifier header is x-request-id.

Steps and expected results

Send an unsigned request to a protected endpoint: expect HTTP 401.
Send a correctly signed request with a current validity window: expect normal authentication and authorization.
Modify the signed identifier, use another algorithm, or exceed the configured maximum lifetime: expect HTTP 401.
Send expired or malformed signatures: expect an error response.
Call an excluded health endpoint without a signature: expect public access.
Send a correctly signed webhook request: connector authentication must still apply, and payload bytes must remain unchanged.
Disable verification and restart: expect existing authentication behavior.

Breaking changes

Behavior modification: signature verification defaults to enabled outside the local and test profiles.
Enabled deployments require a shared secret at startup.
Unsigned requests to non-excluded endpoints return HTTP 401.

Context of the Breaking Change

HTTP message signature verification adds a security check before existing authentication.

Result of the Breaking Change

Deployments must configure signing clients and a shared secret before enabling this feature, or explicitly disable verification during rollout.

+        "/v3/api-docs/**"}) List<String> excludedPaths){
+
+  /// Validates startup policy and takes an immutable copy of the exclusion paths.
+  public HttpMessageSignatureProperties {


github-code-quality · 2026-11-05T16:18:50Z

Code coverage overview

Languages: Java

Java / code-coverage/jacoco

main 017c4b0	feat/enforce-api-gat... 73b7b5d	+/-
91%	92%	+1%

View coverage of the 10 most impacted files.

File	main 017c4b0	feat/enforce-api-gat... 73b7b5d	+/-
`com/decathlon/i...ationUtils.java`	87%	89%	+2%
`com/decathlon/i...hainConfig.java`	97%	100%	+3%
`com/decathlon/i...hainConfig.java`	85%	100%	+15%
`com/decathlon/i...reVerifier.java`	0%	96%	+96%
`com/decathlon/i...tureParser.java`	0%	100%	+100%
`com/decathlon/i...tureFilter.java`	0%	100%	+100%
`com/decathlon/i...figuration.java`	0%	100%	+100%
`com/decathlon/i...Properties.java`	0%	100%	+100%
`com/decathlon/i...eAlgorithm.java`	0%	100%	+100%
`com/decathlon/i...tureResult.java`	0%	100%	+100%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

_{Updated November 13, 2026 17:09 UTC}

Copilot

🟡 Changes recommended

Signature verification rejects valid CORS preflights with 401, preventing allowed origins from sending signed requests, and path-only exclusions cannot resolve this without also bypassing endpoint protection.

1 open issue

Allow CORS preflights before signature verification · New

What changed in this PR

This PR adds shared-secret HTTP signature verification ahead of IDP-Core’s existing API and webhook authentication.

Changes:

Adds signature parsing, HMAC verification, validity checks, exclusions, and standardized rejection responses.
Integrates verification into all security chains, enabled by default with local, test, and CI opt-outs.
Documents the signing contract and adds unit and integration coverage.

File	Description
`src/test/resources/application-test.yml`	Disables verification by default in tests.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/PublicFilterChainConfigTest.java`	Supplies the shared signature configurer.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/OAuth2LoginFilterChainConfigTest.java`	Updates OAuth2 chain setup.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/MockFilterChainConfigTest.java`	Updates mock chain setup.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/JwtFilterChainConfigTest.java`	Updates JWT chain setup.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/ApiKeyFilterChainConfigTest.java`	Updates API-key chain setup.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureVerifierTest.java`	Tests algorithms, timestamps, parsing, and tampering.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureIntegrationTest.java`	Tests HTTP enforcement and webhook compatibility.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureFilterTest.java`	Tests exclusions, rejection responses, and payload preservation.
`src/test/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureConfigurationTest.java`	Tests configuration validation and filter wiring.
`src/main/resources/application.yml`	Defines environment-backed signature settings.
`src/main/resources/application-local.yml`	Defaults local verification to disabled.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/ingestion/configuration/IngestionSecurityConfiguration.java`	Applies verification to webhook ingestion.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/PublicFilterChainConfig.java`	Applies verification to public routes.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/OAuth2LoginFilterChainConfig.java`	Applies verification to OAuth2 login.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/MockFilterChainConfig.java`	Applies verification to mock authentication.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/JwtFilterChainConfig.java`	Applies verification to JWT authentication.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/security/chains/ApiKeyFilterChainConfig.java`	Applies verification to the API-key chain.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/HttpMessageSignatureProperties.java`	Defines and validates signature policy.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/HttpMessageSignatureConfiguration.java`	Creates and positions the optional verification filter.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/configuration/HttpMessageSignatureAlgorithm.java`	Defines supported HMAC algorithms.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureVerifier.java`	Validates signature bytes and validity windows.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureResult.java`	Defines verification outcomes and error descriptions.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureParser.java`	Parses the restricted legacy signature format.
`src/main/java/com/decathlon/idp_core/infrastructure/adapters/api/auth/http_message_signature/HttpMessageSignatureFilter.java`	Enforces signatures and writes rejection responses.
`docs/src/deployment/configuration.md`	Documents deployment settings and defaults.
`docs/src/concepts/authentication.md`	Explains signing, exclusions, errors, and limitations.
`.github/workflows/basic_code_checks.yml`	Disables verification during Swagger validation.

_{Review effort: Balanced}

sonarqubecloud · 2026-11-13T17:09:19Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

feat(security): enforce HTTP request signature validation

03587f3

github-code-quality Bot found potential problems Nov 5, 2026

View reviewed changes

Comment thread ...thlon/idp_core/infrastructure/adapters/api/configuration/HttpMessageSignatureProperties.java

"/v3/api-docs/**"}) List<String> excludedPaths){

/// Validates startup policy and takes an immutable copy of the exclusion paths.

public HttpMessageSignatureProperties {

evebrnd and others added 3 commits November 5, 2026 17:35

fix: fix code issues

cbdf782

Merge branch 'main' into feat/enforce-api-gateway-request-signature

e20462e

Merge branch 'main' into feat/enforce-api-gateway-request-signature

1962a45

evebrnd requested a balanced review from Copilot November 9, 2026 09:09

Copilot started reviewing on behalf of evebrnd November 9, 2026 09:10

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Comment thread ...on/idp_core/infrastructure/adapters/api/configuration/HttpMessageSignatureConfiguration.java Resolved

fix: allow CORS preflights before signature

eb44150

evebrnd marked this pull request as ready for review November 9, 2026 10:10

evebrnd and others added 2 commits November 10, 2026 09:16

Merge branch 'main' into feat/enforce-api-gateway-request-signature

72f0555

Merge branch 'main' into feat/enforce-api-gateway-request-signature

c4f7434

brandPittCode requested changes Nov 12, 2026

View reviewed changes

Comment thread docs/src/deployment/configuration.md Resolved

Comment thread ...dp_core/infrastructure/adapters/api/configuration/security/chains/MockFilterChainConfig.java Resolved

brandPittCode and others added 2 commits November 12, 2026 18:17

Merge branch 'main' into feat/enforce-api-gateway-request-signature

4f7a72d

chore: rename to http-message-signature-verification

73b7b5d

Navigation Menu

Repository navigation

feat(security): enforce HTTP request signature validation - #185

feat(security): enforce HTTP request signature validation#185
evebrnd wants to merge 9 commits into
mainfrom
feat/enforce-api-gateway-request-signature

evebrnd commented Nov 5, 2026 •

edited

Loading

Uh oh!

github-code-quality Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Nov 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

evebrnd commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Description

What this PR Provides

Review

How to test

Breaking changes

Context of the Breaking Change

Result of the Breaking Change

Uh oh!

github-code-quality Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code coverage overview

Java / code-coverage/jacoco

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Nov 13, 2026

Quality Gate passed

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

evebrnd commented Nov 5, 2026 •

edited

Loading

github-code-quality Bot commented Nov 5, 2026 •

edited

Loading