cortana-verifier v1.0.0

cortana-verifier

Verify HTTP requests sent to a Cortana skill are sent from Microsoft.

This module is framework-agnostic.

Motivation

For Cortana Skills, the skill endpoint should verify that requests are actually coming from Microsoft. This is enforced by checking:

• the timestamp of the request
• the validity of the certificate
• the signature of the request signed with the aforementioned certificate

This module provides a function to handle this validation.

Usage

const verifier = require('cortana-verifier')


verifier(cert_url, signature, requestRawBody, callback)

• cert_url full url of the certificate to verify (from HTTP request header named signaturecertchainurl)
• signature signature of the request (from HTTP request header named signature)
• requestRawBody full body string from POST request
• callback completion function. has 1 argument which indicates error. falsey when verification passes

Note: The interface to this module is the same as the interface to the alexa-verifier module. If you are already using alexa-verifier, simply require this module instead.