diff --git a/py_builder_signing_sdk/signing/hmac.py b/py_builder_signing_sdk/signing/hmac.py index 0f81960..056125d 100644 --- a/py_builder_signing_sdk/signing/hmac.py +++ b/py_builder_signing_sdk/signing/hmac.py @@ -10,7 +10,8 @@ def build_hmac_signature( Creates an HMAC signature by signing a payload with the secret """ base64_secret = base64.urlsafe_b64decode(secret) - message = str(timestamp) + str(method) + str(requestPath) + signing_path = str(requestPath).split("?", 1)[0] + message = str(timestamp) + str(method) + signing_path if body: # NOTE: Necessary to replace single quotes with double quotes # to generate the same hmac message as go and typescript diff --git a/setup.py b/setup.py index b44b892..69af4f3 100644 --- a/setup.py +++ b/setup.py @@ -5,7 +5,7 @@ setuptools.setup( name="kuest-py-builder-signing-sdk", - version="2.0.1", + version="2.0.2", author="Kuest Engineering", author_email="engineering@kuest.com", maintainer="Kuest Engineering", diff --git a/tests/signing/test_hmac.py b/tests/signing/test_hmac.py index 9809a68..3dc59aa 100644 --- a/tests/signing/test_hmac.py +++ b/tests/signing/test_hmac.py @@ -17,3 +17,21 @@ def test_build_hmac_signature(self): signature, "ZwAdJKvoYRlEKDkNMwd5BuwNNtg93kNaR_oU2HrfVvc=", ) + + def test_query_parameters_are_excluded_from_signature(self): + path_signature = build_hmac_signature( + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "1000000", + "test-sign", + "/orders", + '{"hash": "0x123"}', + ) + query_signature = build_hmac_signature( + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", + "1000000", + "test-sign", + "/orders?market=condition", + '{"hash": "0x123"}', + ) + + self.assertEqual(query_signature, path_signature)