Method verifyInteraction

api/pkg/handlers/discord_handler.go:423–459

verifyInteraction implements message verification of the discord interactions api signing algorithm, as documented here: https://discord.com/developers/docs/interactions/receiving-and-responding#security-and-authorization

(ctxLogger telemetry.Logger, c fiber.Ctx)

// signing algorithm, as documented here:
// https://discord.com/developers/docs/interactions/receiving-and-responding#security-and-authorization
func (h *DiscordHandler) verifyInteraction(ctxLogger telemetry.Logger, c fiber.Ctx) bool {
	var msg bytes.Buffer

	signature := c.Get("X-Signature-Ed25519")
	if signature == "" {
		ctxLogger.Info("X-Signature-Ed25519 header is empty")
		return false
	}

	sig, err := hex.DecodeString(signature)
	if err != nil {
		ctxLogger.Info(fmt.Sprintf("cannot decode X-Signature-Ed25519 [%s]", signature))
		return false
	}

	if len(sig) != ed25519.SignatureSize {
		ctxLogger.Info(fmt.Sprintf("invalid signature size [%d]", len(sig)))
		return false
	}

	timestamp := c.Get("X-Signature-Timestamp")
	if timestamp == "" {
		ctxLogger.Info("X-Signature-Timestamp header is empty")
		return false
	}

	msg.WriteString(timestamp)
	msg.Write(c.Body())

	key, err := hex.DecodeString(os.Getenv("DISCORD_PUBLIC_KEY"))
	if err != nil {
		ctxLogger.Error(stacktrace.Propagate(err, "cannot decode DISCORD_PUBLIC_KEY env variable [%s]", os.Getenv("DISCORD_PUBLIC_KEY")))
		return false
	}

	return ed25519.Verify(key, msg.Bytes(), sig)
}