DataV:Check the validity of digitally signed parameters in a token

Prerequisites

Before you use this method, make sure that:

• Data visualization screenUse token authenticationFor more information, see Publish a visualized application on a PC.

• The dashboard uses GET to pass parameters in the URL.

• The URL parameters must be protected from tampering.

Scenarios

The following example illustrates when and why to use token parameter signature verification.

Assume a DataV dashboard is embedded in a user's system. The URL is generated with a token, and the user's job number is passed as a GET parameter so the dashboard displays the corresponding data. The resulting URL looks like https://datav.aliyuncs.com/share/xxx?_datav_time=1556022195845&_datav_signature=%2BDZFj3QDIla%2F00fBZLdJMgk2Z1Ocs9MLL1******%3D&workid=123.

The workid (job ID) parameter may be tampered with. For example, an employee with job number 123 could change the URL to https://datav.aliyuncs.com/share/xxx?_datav_time=1556022195845&_datav_signature=%2BDZFj3QDIla%2F00fBZLdJMgk2Z1Ocs9MLL1******%3D&workid=124 to view the data of employee 124. To prevent this, enable signature authentication. After signature authentication is enabled, any modification to signed parameters in the URL invalidates the link.

Parameter Rules

A parameter is included in signature calculation only if its name starts with datav_sign_ (matching the regular expression /^datav_sign_.*/).

URL with signature parameters

The following Node.js sample code generates a signed URL:

const crypto = require('crypto');
const querystring = require('querystring');
const signedQueryParamReg = /^ datav_sign_.*/; // Parameters that conform to this regular expression need to be signed. 

const token = "93TWnmeBtxxxxxxxxxx3thGyAgzennsS";
const screenID ="b92xxxxxxxxxxxxxxxxxx27b4c538cd4";
const time = Date.now();

const customeParams = {
  datav_sign_no: 123998,
  name: 123
};
let signParamsStr = Object.keys(customeParams)
  .filter(paramName => customeParams[paramName] && signedQueryParamReg.test(paramName))
  .sort()
  .map(param => `${param}=${customeParams[param]}`)
  .join('&');
let stringToSign = [screenID, time];
signParamsStr && stringToSign.push(signParamsStr);
stringToSign = stringToSign.join('|');
let signature = crypto.createHmac('sha256', token).update(stringToSign).digest().toString('base64');
let queryParams = {
  _datav_time: time,
  _datav_signature: signature
};

Object.keys(customeParams).forEach(paramName => {
  queryParams[paramName] = customeParams[paramName];
});

let url = `https://datav.aliyuncs.com/share/${screenID}?${querystring.stringify(queryParams)}`;
console.log(url);

The preceding code produces a URL like: https://datav.aliyuncs.com/share/b92db8e09358c82efca0727b4c538cd4?_datav_time=1556023246894&_datav_signature=GGSbvxlemUeBoRVco8JgrJVWRcmao7NuRYt2O******%3D&datav_sign_no=123998&name=123. While the URL is valid, modifying the datav_sign_no value makes the link inaccessible, because this parameter follows the parameter rules and is included in the signature. However, modifying name does not affect access because name does not match the naming convention and is not signed.

Procedure

1. Determine the names of the parameters that must be signed. These parameters cannot be tampered with after they are passed.

2. After the data visualization dashboard is developed, Use token authenticationPublish a data visualization dashboard. For more information, see Publish a visualization application on a PC.

3. Calculate the URL of the data visualization dashboard. For more information, see Calculate the URL with signature parameters.

4. Use the URL calculated in the previous step to access the data visualization screen. During the access, the system automatically verifies the parameter signature.

   If the verification succeeds and you change the signature parameters in the URL, the access is denied when you access the URL next time.