​
Validating Signatures

Requests from the OwnID server include two headers that can be used to ensure the request has not been tampered with. The first one, ownid-signature, is a hash value that the OwnID server generates from a timestamp and the body of the request. The second one, ownid-timestamp can be used by your backend to calculate the signature that is based on the timestamp and request body, and then compare the result to the value of ownid-signature. If both signatures do not match, the request has been altered. Because the signatures are generated using an HMAC with the SHA256 hash function, the OwnID server and your backend must use the same cryptographic key when calculating the hash value. You can obtain this key from the OwnID Console, and then add the code generates a hash and compares it to the signature in your backend. Obtaining the HMAC Key Before the backend can generate the HMACSHA256 value, you must obtain the secret cryptographic key used in the calculation. Simply open your OwnID application in the OwnID Console and copy the value from MyApp > Shared Secret. Request Verification Now that you have the cryptographic key, the backend can verify requests by generating each request’s expected signature and compare it to the one generated by the OwnID server. The backend code must:
  • Step 1: Extract the ownid-signature and ownid-timestamp headers from the request. These headers provide the HMAC code generated by the OwnID server and the timestamp it used to generate it.
  • Step 2: Validate the ownid-timestamp for expiration. To prevent replay attacks, check whether the provided timestamp is within an acceptable time window. Define a preferred expiration time, such as 1 minute, and validate against the current time. Requests with a timestamp older than this period should be rejected.
  • Step 3: Create the data string that will be used as an input to the hash function. To create it you need to concatenate:
    • The request body (in a JSON string format)
    • The character .
    • The timestamp (from the ownid-timestamp header)
  • Step 4: Use HMAC with SHA256 to calculate a hashed value from the body-timestamp data string. The cryptographic key used in the calculation is the shared secret for your OwnID application.
  • Step 5: Compare the hash value generated by your backend with the signature extracted from the ownid-signature header.
The following code snippets show how the backend might accomplish these steps: 
const crypto = require('crypto');

// Step 1: Extract values from headers and request body
let key = "<your-shared-secret>"; // This is the shared secret from OwnID Console
let keyBuffer = Buffer.from(key, 'base64');
let body = JSON.stringify(req.body);
let ownIdSignature = req.headers['ownid-signature'];
let ownIdTimestamp = req.headers['ownid-timestamp'];
let dataToSign = `${body}.${ownIdTimestamp}`;

// Step 2: Validate the `ownid-timestamp` for expiration
const expirationTimeInMilliseconds = 60 * 1000; 
const currentTime = Date.now(); /
const ownIdTimestampMs = parseInt(ownIdTimestamp);

if (Math.abs(currentTime - ownIdTimestampMs) > expirationTimeInMilliseconds) {
    // The timestamp has expired
    throw new Error("Request rejected: Signature has expired.");
}

// Step 3: Generate HMAC signature
const hmac = crypto.createHmac('sha256', keyBuffer);
hmac.update(dataToSign);
let signature = hmac.digest('base64');

// Step 4: Compare the generated signature with the one from the header
if (signature !== ownIdSignature) {
    // The request has been tampered with
    throw new Error("Request rejected: Invalid signature.");
}

​
IP allowlisting

OwnID enforces IP allowlisting to make server-to-server calls to your servers. In order to allowlist OwnID calls, please consider the following IP addresses:
  • 18.213.107.140
  • 35.175.77.229

​
Using Content-Security-Policy

When implementing Content-Security-Policy response headers in your site, you must be sure to include *.ownid.com in the rule definitions for specific policies for them to function properly. An example rule set would look similar to the following: 
<meta http-equiv="content-security-policy" content="script-src 'unsafe-eval' 'self' *.ownid.com;">

​
Important Next Steps

Custom Domain

Unify the login experience with your own domain.