µ - APIs with HMAC

readme.md

µ - APIs with HMAC

It is a microapp to handle routing with HMAC signature. Pretty tiny.

Start

$ SEC=secret php -S 0.0.0.0:1337 mu.php

Query

$ curl http://127.0.0.1:1337/hello/ganglio\?SIG\=3704c89159adabf4b487ec1507a81ca00c9180e0d18e7d5f2be27c7cb252bb72

mu.php

<?php

if (
        file_exists(__DIR__ . $_SERVER['REQUEST_URI']) &&
        !is_dir(__DIR__ . $_SERVER['REQUEST_URI'])
    ) {
    return false;
}

$secret    = getenv("SEC");
@$signature = $_SERVER['HTTP_SIG'] || $_REQUEST['SIG'];

@$method  = $_SERVER['REQUEST_METHOD'];
@$path    = $_SERVER['REQUEST_URI'];
@$body    = file_get_contents('php://input');

$expected = hash_hmac("sha256",$method . $path . $body, $secret);

if ($expected != $signature) {
    die("Invalid signature $expected");
}

parse_str(explode("?",$path)[1],$args);
$path = explode("?",$path)[0];

$routes = [
    "/hello/{world}" => function ($world) use ($args) { echo "Hello, $world!"; }
];

foreach ($routes as $route=>$methods) {
    $regex = "/^" . str_replace("/", "\/",
        preg_replace("/(\{[^}]*\})/", "(.*)", $route)
    ) . "$/";
    if (preg_match($regex, $path, $params)) {
        unset($params[0]);
        if (is_callable($methods)) {
            call_user_func_array($methods, $params);
            die();
        } else if (isset($methods[$method])) {
            call_user_func_array($methods[$method], $params);
            die();
        }
    }
}

header("HTTP/1.0 404 Not Found");
die();