Pusher 签名无效：预期的 HMAC SHA256 十六进制摘要答案

【问题标题】：Pusher Invalid signature: Expected HMAC SHA256 hex digest ofPusher 签名无效：预期的 HMAC SHA256 十六进制摘要
【发布时间】：2014-11-26 06:55:52
【问题描述】：

我在一个 HTML 文件中有 JavaScript 代码，我从该文件中调用服务器进行身份验证：

<html>
<script>
<head>
    var options = { authEndpoint: "api/pusher.json?socket_id=9900&channel_name=presence-channel" }
    var pusher = new Pusher('98384343434343434', options);
    pusher.connection.bind('connected', function() {
        console.log("connected");
        socketId = pusher.connection.socket_id;
        console.log("socketId" + socketId);
    });

    var channel = pusher.subscribe('presence-channel');
</script>
</head>
<body></body>
</html>

服务器端代码如下：

import com.pusher.rest.Pusher;
import com.pusher.rest.data.PresenceUser;
import com.webapp.actions.BusinessApiAction;


@Path("/api/pusher")
public class PusherAction extends BusinessApiAction {
    @POST

    @Produces({ "application/Json", "application/xml" })
    public Response pusher(@Context ServletContext context, @Context HttpServletRequest req, @Context HttpServletResponse res, @FormParam("socket_id") String socketId, @FormParam("channel_name") String channelName) throws Exception {
        System.out.println("\n\n===channel==> " + channelName + "\t socket id-->" + socketId);

        Pusher pusher = new Pusher("92063", "3055e2b132174078348c", "52cfe6c7ecb8420ad981");
        String userId = "5433d5da97d88628ec000300";
        Map<String, String> userInfo = new HashMap<>();
        userInfo.put("name", "Phil Leggetter");

        String authBody = pusher.authenticate(socketId, channelName, new PresenceUser(userId, userInfo));
        JSONObject j = new JSONObject(authBody);
        System.out.println("\n\n===authBody==> " + j.getString("auth"));
        Map<String, Object> map = new HashMap<>();
        Map<String, Object> channelData = new HashMap<>();
        map.put("auth", j.getString("auth"));
        JSONObject ch = new JSONObject(j.getString("channel_data"));
        channelData.put("user_id", ch.getString("user_id"));
        channelData.put("user_info", userInfo);
        map.put("channel_data", ch.toString());

        return sendDataResponse(map);
        }

}

返回的响应是 200，但 Pusher 给出了这个错误：推送记录器出错--

Pusher : Event sent : {"event":"pusher:subscribe","data":{"auth":"3055e2b132174078348c:980bf9a6d3a61d280d181785ccacd0e5e7999776085403f2d9bfe688842b8fe7","channel_data":"{\"user_info\":{\"name\":\"Phil Leggetter\"},\"user_id\":\"5433d5da97d88628ec000300\"}","channel":"presence-user2"}}

Pusher : Event recd : {"event":"pusher:error","data":{"code":null,"message":"Invalid signature: Expected HMAC SHA256 hex digest of 41797.10543542:presence-user2:{\"user_info\":{\"name\":\"Phil Leggetter\"},\"user_id\":\"5433d5da97d88628ec000300\"}, but got 980bf9a6d3a61d280d181785ccacd0e5e7999776085403f2d9bfe688842b8fe7"}}

Pusher : Error : {"type":"WebSocketError","error":{"type":"PusherError","data":{"code":null,"message":"Invalid signature: Expected HMAC SHA256 hex digest of 41797.10543542:presence-user2:{\"user_info\":{\"name\":\"Phil Leggetter\"},\"user_id\":\"5433d5da97d88628ec000300\"}, but got 980bf9a6d3a61d280d181785ccacd0e5e7999776085403f2d9bfe688842b8fe7"}}}

【问题讨论】：

您已在上面分享了您的应用程序密码。您能否确保在 Pusher 仪表板中重置您的应用程序密码？您可以从 App Keys -> App Credentials 部分执行此操作。

标签： java javascript pusher

【解决方案1】：

从pusher.authenticate 返回的authBody 应该为您提供响应客户端请求所需的一切。您只需要确保 sendDataResponse 将 authBody 作为 JSON 的响应正文发送回来。

我已更新您提供的示例以删除不需要的行：

@Path("/api/pusher")
public class PusherAction extends BusinessApiAction {
    @POST

    @Produces({ "application/Json", "application/xml" })
    public Response pusher(@Context ServletContext context, @Context HttpServletRequest req, @Context HttpServletResponse res, @FormParam("socket_id") String socketId, @FormParam("channel_name") String channelName) throws Exception {
        System.out.println("\n\n===channel==> " + channelName + "\t socket id-->" + socketId);

        Pusher pusher = new Pusher(APP_ID, APP_KEY, APP_SECRET);
        String userId = "5433d5da97d88628ec000300";
        Map<String, String> userInfo = new HashMap<>();
        userInfo.put("name", "Phil Leggetter");

        String authBody = pusher.authenticate(socketId, channelName, new PresenceUser(userId, userInfo));

        return sendDataResponse(authBody);
    }

}

pusher-rest-java 库自述文件显示了不需要的附加功能： https://github.com/pusher/pusher-rest-java#authenticating-presence-channels

【讨论】：

感谢@leggetter 的回复，我尝试使用 var options={authEndpoint: "api/pusher.json" };但我得到错误参数 [socketId] 不应为空。我错过了什么吗？
应该是socket_id 而不是socketId。
@Kamini 您能否更新问题以提供有关pusher.json 处理代码的更多信息？例如获取查询参数。
@Kamini 太棒了！您能否将我的回复标记为答案？
只是想了解客户端到客户端的通信，现在我有 2 个 html 文件，每当我在服务器 api/pusher 中写入结果结果 = pusher.trigger(channelName, "client-event", authBody);并在 client1.html 中写入 channel.bind('client-event', function(data) { alert("data from server api-->"+data); });在这里，无论发送什么 authbody 数据，我都会收到警报，但我希望它由客户端到客户端的通信完成，我尝试在一个 client2.html channel.trigger('client-event',{ data:'hello client1'} 中使用);但在绑定该事件的其他 client1.html 中没有收到警报