# alexa-verifier

> Verify HTTP requests sent to an Alexa skill are sent from Amazon

Latest version **4.0.0** (published 2023-12-14) · MIT license · 0 weekly downloads

## Install

```sh
npm install alexa-verifier
pnpm add alexa-verifier
yarn add alexa-verifier
bun add alexa-verifier
```

## Health

**Score 20/100 (F)** — status: abandoned.

Positive: esm support; no vulnerabilities.

Warnings: low downloads; no types.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 4.0.0 |
| Published | 2023-12-14 |
| First published | 2016-01-27 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | ESM + CommonJS |
| Node | >=12.17 |
| Dependencies | 2 |
| Unpacked size | 44 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 74 |
| Author | Mike Reinstein |
| Maintainers | mreinstein, mkruse |
| Keywords | alexa, amazon, echo, skill, validation |

## Links

- npm: https://www.npmjs.com/package/alexa-verifier
- Repository: https://github.com/mreinstein/alexa-verifier
- Homepage: https://github.com/mreinstein/alexa-verifier#readme
- Issues: https://github.com/mreinstein/alexa-verifier/issues
- npm.io page: https://npm.io/package/alexa-verifier

## Dependencies (2)

- [validator](https://npm.io/package/validator.md) ^13.7.0
- [node-forge](https://npm.io/package/node-forge.md) ^1.2.1

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 4.0.0 (latest) — 2023-12-14
- 3.0.2 — 2022-01-13
- 3.0.1 — 2021-05-24
- 3.0.0 — 2021-05-24
- 2.0.2 — 2020-09-18
- 2.0.1 — 2018-05-04
- 2.0.0 — 2018-05-04
- 1.0.0 — 2017-11-03
- 0.5.0 — 2017-09-19
- 0.4.0 — 2017-08-21
- 0.3.6 — 2017-04-11
- 0.3.5 — 2017-04-03
- 0.3.4 — 2017-04-03
- 0.3.3 — 2017-03-26
- 0.3.2 — 2017-03-26
- … 12 more at https://npm.io/package/alexa-verifier/versions

## README

# alexa-verifier

![tests](https://github.com/mreinstein/alexa-verifier/actions/workflows/main.yml/badge.svg)


Verify HTTP requests sent to an Alexa skill are sent from Amazon.

This module is framework-agnostic.

If you're using expressjs, you should check out [alexa-verifier-middleware](https://github.com/alexa-js/alexa-verifier-middleware) which is a lot easier to integrate.



### motivation
Part of the certication process for alexa skills hosted on a generic web service (i.e., not AWS Lambda) is that your skill must validate requests are actually coming from Amazon. This is enforced by checking:

* the timestamp of the request
* the validity of the certificate
* the signature of the the request signed with the aforementioned certificate

This module provides a function to handle this validation.


### usage

arguments
* `cert_url`  full url of the certificate to verify (from HTTP request header named `signaturecertchainurl`)
* `signature` signature of the request (from HTTP request header named `signature`)
* `requestRawBody`  full body string from POST request
* `callback`  (optional) completion function. has 1 argument which indicates error. falsey when verification passes

You may include a callback function, in the standard node error argument-first format:

```javascript
import verifier from 'alexa-verifier'


verifier(cert_url, signature, requestRawBody, function callbackFn (er) {
    // if er, something went wrong
})
```

Ommiting a callback function returns a promise:

```javascript
const verifyPromise = verifier(cert_url, signature, requestRawBody)
```

---
_Source: https://npm.io/package/alexa-verifier · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._