对Web-API有效负载实施HMAC身份验证的正确方法是什么？

Question

我想为API有效负载创建HMAC authentication。我为此使用Node.js和crypto。由于我是Node.js的新手，并且是第一次从事HMAC的工作，因此提出了以下建议。

我想确保这是正确的方法。如果我可以改进此代码，那么我将不胜感激这些建议。

代码：

import * as crypto from "crypto";

const ENCRYPTION_KEY = crypto.randomBytes(32); // Must be 256 bytes (32 characters)
const IV_LENGTH = 16; // For AES, this is always 16
const ALGORITHM = "aes-256-cbc";
const ENCODING = "hex";

function encrypt(text) {
  let iv = crypto.randomBytes(IV_LENGTH);
  let cipher = crypto.createCipheriv(
    ALGORITHM,
    Buffer.from(ENCRYPTION_KEY),
    iv
  );
  let encrypted = cipher.update(text);

  encrypted = Buffer.concat([encrypted, cipher.final()]);

  return iv.toString(ENCODING) + ":" + encrypted.toString(ENCODING);
}

function decrypt(text) {
  let textParts = text.split(":");
  let iv = Buffer.from(textParts.shift(), ENCODING);
  let encryptedText = Buffer.from(textParts.join(":"), ENCODING);
  let decipher = crypto.createDecipheriv(
    ALGORITHM,
    Buffer.from(ENCRYPTION_KEY),
    iv
  );
  let decrypted = decipher.update(encryptedText);

  decrypted = Buffer.concat([decrypted, decipher.final()]);

  return decrypted.toString();
}

const sampleJson = {
  data: [
    {
      type: "articles",
      id: "1",
      attributes: {
        title: "JSON:API paints my bike shed!",
        body: "The shortest article. Ever.",
        created: "2015-05-22T14:56:29.000Z",
        updated: "2015-05-22T14:56:28.000Z"
      },
      relationships: {
        author: {
          data: { id: "42", type: "people" }
        }
      }
    }
  ],
  included: [
    {
      type: "people",
      id: "42",
      attributes: {
        name: "John",
        age: 80,
        gender: "male"
      }
    }
  ]
};

var sampleJsonInString = JSON.stringify(sampleJson);

var encrypted = encrypt(sampleJsonInString);
console.log("Encrypted!! \n" + encrypted);

var decrypted = decrypt(encrypted);
console.log("Decrypted!! \n" + decrypted);

输出：

已加密！

80a71c05e7f05f7410f52abcc687f9ce:779ffcc3607d3413695eee8f8bd218f2da864257c08c112d0bc39c601a19e655d14784fe04239cd2d45a80c10c23ea02ffa21d78d9712c09400b6f57caf3cd1eacd1714433531c52a033312d79dc89acba9c941f009653a2313d2981ea75f7818ec21e4fede2e795b078b8e89c7721efb8dbbf4acb72bd960b71fe06d431f417f8a1b5896d9e07cb9606cde06ac03f141dde8724fb070310e8583c096587ce0e97489b91257b3e11a23b9282b3ca17a0b12773dc534c072154708966d10bfaff7d8295dd386e78d725c85949ecaf6ba1939d645462d4f3183d32ab564e3fc05d1002f4fd189e7d6137d5350814395a1333c66f46d2d576a8e2d02b1c727185f47bf984b73d7b8e1a7b4b485bff86408f15c5f50757d4d859ea5af4e6a718a9ded65bc9db54ef30c57d0cb72b54392cb8992c0d729e0d309db01bd3204906d6e7c890b39203d1b0d2e5163dbf6484153fbf3a6adf6ecef8c6e5231ee05b4070df5c684401f899f642584f71a8b6ed4d48

已解密！

{"data":[{"type":"articles","id":"1","attributes":{"title":"JSON:API paints my bike shed!","body":"The shortest article. Ever.","created":"2015-05-22T14:56:29.000Z"
,"updated":"2015-05-22T14:56:28.000Z"},"relationships":{"author":{"data":{"id":"42
","type":"people"}}}}],"included":[{"type":"people","id":"42","attributes":{"name"
:"John","age":80,"gender":"male"}}]}