Conversation
Open
2 tasks
rikukissa
approved these changes
Aug 6, 2026
Member
Author
|
I tested this on integration environment and the records seem to come through fine. I'm happy to merge this for 2.1 but only after Tahmid's fixes for 2.0.1. |
Member
Author
|
Continuing the PR here opencrvs/opencrvs-core#13561 |
naftis
added a commit
to opencrvs/opencrvs-core
that referenced
this pull request
Aug 25, 2026
* tighten security by enabling HMAC on WebSub Ports opencrvs/mosip#168 into core, now that packages/mosip-api lives here. WebSub callbacks are authenticated with the hub's X-Hub-Signature HMAC and rejected with a 401 if it is missing or does not match. Previously nothing established that a callback came from MOSIP: the route is exempt from JWT auth, and decrypting the credential only proves the sender had OpenCRVS's public certificate, which is not a secret. This replaces the credential's RsaSignature2018 proof as the source check, so the proof verification and the canonicalize dependency are removed along with MOSIP_VERIFIABLE_CREDENTIAL_ALLOWLIST. * remove redundant comment * make onAssign run promises in parallel to save time * rename BODY to rawBody * add Promise.all to api.ts wherever applicable
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why not enable proof verification with the VCs?
RsaSignature2018MOSIP uses signs the URDNA2015 RDF canonicalization of the credential. The canonicalization depends on the JSON-LD context of the credential and can vary between environments.We are now secured for:
getTransactionAndDiscarddoes remove the record from the databasehub.secretis shared between MOSIP's hub and mosip-api