Hello,

I'm using a demo access to the worldcheck api.

I have my key and my secret key.

Postman is working. I have access and results.

I've 401 Unauthorised Access problems when I try to implement the access through frontend (vuejs using either fetch or axios) or through backend (php).

For vue js, I adapted the nodejs example. And the code is really similar (javascript in both cases).

I also compared the authorization header i'm getting in postman and in vue js and they are identical.

Here is an example :

- Vue JS -
Date: Thu, 24 Oct 2019 14:39:52 GMT
Authorization: Signature keyId="******************************",algorithm="hmac-sha256",headers="(request-target) host date",signature="bhT39ij/iE1851ZH402zYahPmAEZtkK/riL/CQvvM4w="

- PostMan
Date: Thu, 24 Oct 2019 14:39:52 GMT
Authorization: Signature keyId="***************************",algorithm="hmac-sha256",headers="(request-target) host date",signature="bhT39ij/iE1851ZH402zYahPmAEZtkK/riL/CQvvM4w="


I would welcome any support or hint of explorations.

Thanks in advance,

Best regards,
Emmanuel

Here is the vue js code :

<template>
<div>
WORLDCHECK
</div>
</template>

<script>
import CryptoJS from 'crypto-js'

export default {


mounted () {
this.initialize()
},

methods: {

generateAuthHeader(dataToSign){
var hash = CryptoJS.HmacSHA256(dataToSign,process.env.worldcheck.WC1_APISECRETKEY);
return hash.toString(CryptoJS.enc.Base64);
},

initialize () {

var gatewayhost = process.env.worldcheck.WC1_GATEWAYHOST;
var gatewayurl = process.env.worldcheck.WC1_GATEWAYURL;
var apikey = process.env.worldcheck.WC1_APIKEY;
var apisecretkey = process.env.worldcheck.WC1_APISECRETKEY;

var date = new Date().toGMTString();

console.log("date", date);

var datas = "";

var dataToSign = "(request-target): get " + gatewayurl + "groups"
+ "\n" + "host: " + gatewayhost
+ "\n" + "date: " + date
// + "\n" + "content-type: " + "application/json"
// + "\n" + "content-length: " + datas.length
// + "\n" + datas
;

console.log("dataToSign", dataToSign);

var hmac = this.generateAuthHeader(dataToSign);
console.log("hmac", hmac);

//var authorisation = 'Signature keyId="' + apikey + '",algorithm="hmac-sha256",headers="(request-target) host date content-type content-length",signature="' + hmac + '"';
var authorisation = 'Signature keyId="' + apikey + '",algorithm="hmac-sha256",headers="(request-target) host date",signature="' + hmac + '"';
console.log("authorisation", authorisation);

// GET headers is just date & authorization, no body
var headers = {"Date": date, "Authorization": authorisation};
//var headers = {"currentdate": date, "authorization": authorisation};
console.log("headers", headers);

var url = 'https://'+gatewayhost+ gatewayurl + 'groups';
console.log("url", url);

fetch(url, {method: 'GET', headers: new Headers(headers)})
.then(response => {
console.log("THIS SHOULD HAVE DATA", response.data);
this.result = response.data
})
.catch(error => {
console.log('fetch',error)
});


},


},
layout:"layout_steps"
}
</script>

<style>
</style>


Here is the php code :

<?php
require_once('./apiinfo.php');

header("Content-Type: application/json; charset=utf-8");
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, PATCH, DELETE');
header('Access-Control-Allow-Headers: X-Requested-With, content-type, Authorization');

$gatewayhost = WC1_GATEWAYHOST;
$gatewayurl = WC1_GATEWAYURL;
$apikey = WC1_APIKEY;
$apisecretkey = WC1_APISECRETKEY;

$dateTime = new DateTime('now GMT');
$date = $dateTime->format('D, d M Y H:i:s') . ' GMT';
$dataToSign = "(request-target): get " . $gatewayurl . "groups"."\n" . "host: " . $gatewayhost . "\n" . "date: " . $date;

$hmac_brut = hash_hmac('sha256', $dataToSign, $apisecretkey);
$hmac = base64_encode($hmac_brut);

$authorisation = "Signature keyId=\"" . $apikey . "\",algorithm=\"hmac-sha256\",headers=\"(request-target) host date\",signature=\"" . $hmac . "\"";
//$headers = {'Date': $date, 'Authorization': $authorisation};

$curl = curl_init();

curl_setopt_array($curl, array(
CURLOPT_URL => "https://rms-world-check-one-api-pilot.thomsonreuters.com/v1/groups",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => array(
"Accept: */*",
"Accept-Encoding: gzip, deflate",
"Authorization: ".$authorisation,
"Cache-Control: no-cache",
"Connection: keep-alive",
"Date: ".$date,
"Host: rms-world-check-one-api-pilot.thomsonreuters.com",
"cache-control: no-cache"
),
));

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
print(json_encode("cURL Error #:" . $err));
} else {
print( $response ? $response : json_encode("EMPTY RESPONSE"));
}