{"id":660,"date":"2005-02-06T11:24:22","date_gmt":"2005-02-06T11:24:22","guid":{"rendered":"http:\/\/beta.robertprice.co.uk\/robblog\/2005\/02\/wsse_authentication_for_atom_using_perl-shtml\/"},"modified":"2005-02-06T11:24:22","modified_gmt":"2005-02-06T11:24:22","slug":"wsse_authentication_for_atom_using_perl-shtml","status":"publish","type":"post","link":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/","title":{"rendered":"WSSE Authentication For Atom Using Perl"},"content":{"rendered":"

\nAtom<\/a> uses the WSSE<\/a> authentication for posting and editing weblogs.\n<\/p>\n

\nMark Pilgrim explains more about this in layman’s terms in an old XML.com article, Atom Authentication<\/a>.\n<\/p>\n

\nThis information is passed in an HTTP header, for example…\n<\/p>\n

HTTP_X_WSSE UsernameToken Username="robertprice", PasswordDigest="l7FbmWdq8gBwHgshgQ4NonjrXPA=", Nonce="4djRSlpeyWeGzcNgatneSA==", Created="2005-2-5T17:18:15Z"
\n<\/code><\/div>\n

\nWe need 4 pieces of information to create this string.\n<\/p>\n

\n
    \n
  1. Username<\/li>\n
  2. Password<\/li>\n
  3. Nonce<\/li>\n
  4. Timestamp<\/li>\n<\/ol>\n<\/div>\n

    \nA nonce is a cryptographically random string in this case, not the word Clinton Baptiste gets in Phoenix Nights<\/a> (thanks to Matt Facer<\/a> for the link). In this case, it’s encoded in base64.\n<\/p>\n

    \nThe timestamp is the current time in W3DTF format<\/a>.\n<\/p>\n

    \nThe for items are then encoded together to form a password digest that is used for the verification of the authenticity of the request on the remote atom system. As it already knows you username and password, it can decrypt the password the nonce and timestamp passed in the WSSE header. It uses the well known SHA1 algorithm to encrypt the pasword and encodes it in base64 for transportation across the web.\n<\/p>\n

    \nWe can use Perl<\/a> to create the password digest, as shown in this example code.\n<\/p>\n

    my $username = "robertprice";
    \nmy $password = "secret password";
    \nmy $nonce = "4djRSlpeyWeGzcNgatneSA==";
    \nmy $timestamp = "2005-2-5T17:18:15Z";
    \nmy $digest = MIME::Base64::encode_base64(Digest::SHA1::sha1($nonce . $timestamp . $password), '');
    \n<\/code><\/div>\n

    \nThe password digest is now stored in the variable $digest<\/var>.\n<\/p>\n

    \nWe can also create the HTTP header from this if needed.\n<\/p>\n

    print qq{HTTP_X_WSSE UsernameToken Username="$username", PasswordDigest="$digest", Nonce="$nonce", Created="$created"n};
    \n<\/code><\/div>\n

    \nPlease note, to use this Perl code, you have to have the MIME::Base64<\/a> and Digest::SHA1<\/a> modules installed. Both are freely available on CPAN<\/a>.\n<\/p>\n

    \nUpdate – 22nd November 2006<\/strong>\n<\/p>\n

    \nSome more recent versions of Atom expect the digest to be generated with a base64 decoded version of the nonce. Using the example above, some example code for this would be…\n<\/p>\n


    \n## generate alternative digest
    \nmy $alternative_digest = MIME::Base64::encode_base64(Digest::SHA1::sha1(MIME::Base64::decode_base64($nonce) . $timestamp . $password), '');
    \n<\/code><\/div>\n

    \nWhen using WSSE for password validation, I now always check the incoming digest with both versions of my generated digested to ensure it’s compatible with different versions of Atom enabled software. One of the best examples of this is the Nokia Lifeblog<\/a>. Older versions expect the nonce to be left, newer versions expect the nonce to be decoded first.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Atom uses the WSSE authentication for posting and editing weblogs. Mark Pilgrim explains more about this in layman’s terms in an old XML.com article, Atom Authentication. This information is passed in an HTTP header, for example… HTTP_X_WSSE UsernameToken Username="robertprice", PasswordDigest="l7FbmWdq8gBwHgshgQ4NonjrXPA=", Nonce="4djRSlpeyWeGzcNgatneSA==", Created="2005-2-5T17:18:15Z" We need 4 pieces of information to create this string. Username Password Nonce … Continue reading “WSSE Authentication For Atom Using Perl”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[2],"tags":[12,17,25,47],"class_list":["post-660","post","type-post","status-publish","format-standard","hentry","category-dev","tag-blog","tag-dev","tag-http","tag-perl"],"yoast_head":"\nWSSE Authentication For Atom Using Perl - Robert Price<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WSSE Authentication For Atom Using Perl - Robert Price\" \/>\n<meta property=\"og:description\" content=\"Atom uses the WSSE authentication for posting and editing weblogs. Mark Pilgrim explains more about this in layman’s terms in an old XML.com article, Atom Authentication. This information is passed in an HTTP header, for example… HTTP_X_WSSE UsernameToken Username="robertprice", PasswordDigest="l7FbmWdq8gBwHgshgQ4NonjrXPA=", Nonce="4djRSlpeyWeGzcNgatneSA==", Created="2005-2-5T17:18:15Z" We need 4 pieces of information to create this string. Username Password Nonce … Continue reading "WSSE Authentication For Atom Using Perl"\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/\" \/>\n<meta property=\"og:site_name\" content=\"Robert Price\" \/>\n<meta property=\"article:published_time\" content=\"2005-02-06T11:24:22+00:00\" \/>\n<meta name=\"author\" content=\"rob\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"rob\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/\"},\"author\":{\"name\":\"rob\",\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/#\\\/schema\\\/person\\\/fac6d5b076e0e14e1fb13e15b542a6c5\"},\"headline\":\"WSSE Authentication For Atom Using Perl\",\"datePublished\":\"2005-02-06T11:24:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/\"},\"wordCount\":329,\"keywords\":[\"Blog\",\"Dev\",\"HTTP\",\"Perl\"],\"articleSection\":[\"Dev\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/\",\"url\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/\",\"name\":\"WSSE Authentication For Atom Using Perl - Robert Price\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/#website\"},\"datePublished\":\"2005-02-06T11:24:22+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/#\\\/schema\\\/person\\\/fac6d5b076e0e14e1fb13e15b542a6c5\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/wsse_authentication_for_atom_using_perl-shtml\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WSSE Authentication For Atom Using Perl\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/#website\",\"url\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/\",\"name\":\"Robert Price\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.robertprice.co.uk\\\/robblog\\\/#\\\/schema\\\/person\\\/fac6d5b076e0e14e1fb13e15b542a6c5\",\"name\":\"rob\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6f0eb511179100a4e968abc70403e33686e6ab3e992e392bedd2ccac01da666c?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6f0eb511179100a4e968abc70403e33686e6ab3e992e392bedd2ccac01da666c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6f0eb511179100a4e968abc70403e33686e6ab3e992e392bedd2ccac01da666c?s=96&d=mm&r=g\",\"caption\":\"rob\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WSSE Authentication For Atom Using Perl - Robert Price","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/","og_locale":"en_GB","og_type":"article","og_title":"WSSE Authentication For Atom Using Perl - Robert Price","og_description":"Atom uses the WSSE authentication for posting and editing weblogs. Mark Pilgrim explains more about this in layman’s terms in an old XML.com article, Atom Authentication. This information is passed in an HTTP header, for example… HTTP_X_WSSE UsernameToken Username="robertprice", PasswordDigest="l7FbmWdq8gBwHgshgQ4NonjrXPA=", Nonce="4djRSlpeyWeGzcNgatneSA==", Created="2005-2-5T17:18:15Z" We need 4 pieces of information to create this string. Username Password Nonce … Continue reading \"WSSE Authentication For Atom Using Perl\"","og_url":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/","og_site_name":"Robert Price","article_published_time":"2005-02-06T11:24:22+00:00","author":"rob","twitter_card":"summary_large_image","twitter_misc":{"Written by":"rob","Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/#article","isPartOf":{"@id":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/"},"author":{"name":"rob","@id":"https:\/\/www.robertprice.co.uk\/robblog\/#\/schema\/person\/fac6d5b076e0e14e1fb13e15b542a6c5"},"headline":"WSSE Authentication For Atom Using Perl","datePublished":"2005-02-06T11:24:22+00:00","mainEntityOfPage":{"@id":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/"},"wordCount":329,"keywords":["Blog","Dev","HTTP","Perl"],"articleSection":["Dev"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/","url":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/","name":"WSSE Authentication For Atom Using Perl - Robert Price","isPartOf":{"@id":"https:\/\/www.robertprice.co.uk\/robblog\/#website"},"datePublished":"2005-02-06T11:24:22+00:00","author":{"@id":"https:\/\/www.robertprice.co.uk\/robblog\/#\/schema\/person\/fac6d5b076e0e14e1fb13e15b542a6c5"},"breadcrumb":{"@id":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.robertprice.co.uk\/robblog\/wsse_authentication_for_atom_using_perl-shtml\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.robertprice.co.uk\/robblog\/"},{"@type":"ListItem","position":2,"name":"WSSE Authentication For Atom Using Perl"}]},{"@type":"WebSite","@id":"https:\/\/www.robertprice.co.uk\/robblog\/#website","url":"https:\/\/www.robertprice.co.uk\/robblog\/","name":"Robert Price","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.robertprice.co.uk\/robblog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.robertprice.co.uk\/robblog\/#\/schema\/person\/fac6d5b076e0e14e1fb13e15b542a6c5","name":"rob","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/6f0eb511179100a4e968abc70403e33686e6ab3e992e392bedd2ccac01da666c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6f0eb511179100a4e968abc70403e33686e6ab3e992e392bedd2ccac01da666c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6f0eb511179100a4e968abc70403e33686e6ab3e992e392bedd2ccac01da666c?s=96&d=mm&r=g","caption":"rob"}}]}},"_links":{"self":[{"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/posts\/660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/comments?post=660"}],"version-history":[{"count":0,"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/posts\/660\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/media?parent=660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/categories?post=660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.robertprice.co.uk\/robblog\/wp-json\/wp\/v2\/tags?post=660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}