System Architecture

Lessons learned scaling webhooks to millions of requests a day

I spent some time going over the Postgres schema of Gitlab. GitLab is an alternative to Github. You can self host GitLab since it is an open source DevOps platform. My motivation to understand the …

There are various design patterns used in UX Design practice. User Interface Design Patterns are used to choose the right input type, form…

Persuasive design isn’t evil. It’s a tool, and like any tool, it can be misused. However, with the right research and thoughtful application, it can be a valuable addition to any designer’s toolkit. Using persuasive design, social and psychological principles can be used to influence user behavior.

Just because people can do something does not guarantee that they will. Firstly, they must be motivated. Secondly, they must be persuaded to make decisions. Understanding the emotions that support the desired behavior is the key to conversion.

When used properly and ethically, persuasive design principles are powerful tools for building meaningful products that help people make better decisions and boost UX. #product #startup #tips #web #app #design #ux #ui

UX design patterns are reusable design components that are used to solve common usability problems that users experience.

Aiming to provide the best possible user experience? UX design patterns allow you to build interfaces and solve the most common issues.

Looking for inspiration and examples of best practices for designing your apps, software, screen flows and products? Look no further than this comprehensive collection of Design Pattern resources.

Learn about the various flows used for authentication and authorization of applications and APIs.

Yubico has been working closely with Microsoft, Google, the FIDO Alliance and W3C to create and drive open standards that pave the way for the future of passwordless login. Learn more about the most commonly asked questions regarding FIDO2, the Security Key by Yubico, and the evolution of a passwordless world.

U2F was developed by Yubico and Google, and contributed to the FIDO Alliance after it was successfully deployed for Google employees.

Beginning today, you can break free from your password and go passwordless with your Microsoft account.

Learn how Microsoft and its partners are advancing IAM through secure passwordless access.

FIDO Alliance is focused on providing open and free authentication standards to help reduce the world’s reliance on passwords, using UAF, U2F and FIDO2.

With support from Google Chrome, Microsoft Edge and Mozilla Firefox, FIDO2 Project opens new era of ubiquitous, phishing-resistant, strong authentication to protect web users worldwide  MOUNTAIN VIEW, Calif., and https://www.w3.org/ […]

This document describes a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. This mechanism supports use cases where the full HTTP message may not be known to the signer, and where the message may be transformed (e.g., by intermediaries) before reaching the verifier. This document also describes a means for requesting that a signature be applied to a subsequent HTTP message in an ongoing HTTP exchange.

HMACs and MACs are authentication codes and are often the backbone of JWT authentication systems. A Message Authentication Code (MAC) is a string of bits that depends on a secret key and is sent with a message to prove the message wasn’t tampered with. HMACs are a more strict version of MACs that offer additional security benefits. MAC - Message Authentication Code MACs are exactly what they sound like; small codes that allow receivers of messages to know who the sender was (authentication).

pThis article describes how to generate an AWS signature version 4 and add it to the web service call request./p p /p h1strongUse Case/strong/h1 pWhen you manually create HTTP requests to AWS EC2, you must sign the requests by using AWS signature version 4./p p /p h1strongApproach/strong/h1 p1. Build a Canonical Request for Signature Version 4/p p /p pTo create a canonical request, concatenate the following components into a single string:/p ulliStart with the HTTP request method (GET, PUT, POST, etc.), followed by a newline character./liliAdd the canonical URI parameter, followed by a newline character./liliAdd the canonical query string, followed by a newline character. If the request does not include a query string, use an empty string (essentially, a blank line)./liliAdd the canonical headers, followed by a newline character./liliAdd the signed headers, followed by a newline character. This value is the list of headers that you included in the canonical headers. By adding this list of headers, you tell AWS which headers in the request are part of the signing process and which ones AWS can ignore. Use hash function SHA256 to create a hashed value from the payload in the body of the HTTP or HTTPS request./liliTo construct the finished canonical request, combine all the components from each step as a single string. /li/ul p /p p2. Create a String to Sign for Signature Version 4/p p /p ulliTo create the string to sign, start with the algorithm designation, followed by a newline character. This value is the hashing algorithm that you use to calculate the digests in the canonical request. For SHA256, AWS4-HMAC-SHA256 is the algorithm./liliAppend the request date value, followed by a newline character. The date is specified with ISO8601 basic format in the x-amz-date header in the format YYYYMMDD'T'HHMMSS'Z'. This value must match the value you used in any previous steps./liliAppend the credential scope value, followed by a newline character. This value is a string that includes the date, the region you are targeting, the service you are requesting, and a termination string ("aws4_request") in lowercase characters. The region and service name strings must be UTF-8 encoded./liliUse hash function SHA256 to create a hashed value from the canonical request. This value is not followed by a newline character. The hashed canonical request must be lowercase base-16 encoded./li/ul p /p p3. Calculate the Signature for AWS Signature Version 4/p p /p pTo calculate a signature, use your secret access key to create a series of hash-based message authentication codes (HMACs). brPseudocode for deriving a signing key:/p blockquote p dir="ltr"kSecret = your secret access keybrkDate = HMAC("AWS4" + kSecret, Date)brkRegion = HMAC(kDate, Region)brkService = HMAC(kRegion, Service)brkSigning = HMAC(kService, "aws4_request")/p /blockquote pUse the signing key that you derived and the string to sign as inputs to the keyed hash function. After you calculate the signature, convert the binary value to a hexadecimal representation./p pbr4. Add the Signing Information to the Request/p pYou can pass signing information either through the Authorization Header or through Query String, but you cannot pass it through both Authorization Header and Query String./p p /p h1strongImplementation/strong/h1 p1. Define 6 Dynamic Process Properties./p ulliPayload - The payload you are sending. This can be empty./liliDate - Current Date. Date needs to be in UTC time zone and the format needs to be yyyyMMdd. /liliRegion - The region you are targeting./liliService - The service you are requesting./liliAccess_Key_ID - Your AWS access key./liliSecretKey - Your AWS secret key./lili /li/ul pBelow is the script to create canonical request and calculate String to Sign./p pre import java.util.Properties; import java.util.Calendar; import java.text.SimpleDateFormat; import java.io.InputStream; import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; import java.security.InvalidKeyException; import com.boomi.execution.ExecutionUtil; import java.nio.charset.StandardCharsets; import javax.xml.bind.DatatypeConverter; import java.security.MessageDigest; import org.apache.commons.codec.binary.Base64; import org.apache.commons.codec.binary.Hex; public class SignString{ public static byte[] HmacSHA256(byte[] key) { MessageDigest mac = MessageDigest.getInstance("SHA-256"); byte[] signatureBytes = mac.digest(key); return signatureBytes; } public static String convertbyte(byte[] bytes) { StringBuffer hexString = new StringBuffer(); for (int j=0; j<bytes.length; j++) { String hex=Integer.toHexString(0xff & bytes[j]); if(hex.length()==1) hexString.append('0'); hexString.append(hex); } return hexString.toString(); } } for( int i = 0; i < dataContext.getDataCount(); i++ ) { InputStream is = dataContext.getStream(i); Properties props = dataContext.getProperties(i); // Acquire applicable Properties Day = ExecutionUtil.getDynamicProcessProperty("Date"); Input = ExecutionUtil.getDynamicProcessProperty("Payload"); Region = ExecutionUtil.getDynamicProcessProperty("Region"); Service = ExecutionUtil.getDynamicProcessProperty("Service"); AccessKey = ExecutionUtil.getDynamicProcessProperty("Access_Key_ID"); version = version number; Date now= new Date(); SimpleDateFormat sdf = new SimpleDateFormat("yyyyMMdd'T'HHmmss'Z'"); TimeZone utc = TimeZone.getTimeZone("UTC"); sdf.setTimeZone(utc); CDT = (sdf.format(now)).toString(); // Build CanonicalHeaders inputs for CanonicalRequest CanonicalHeaders_line1 = "content-type:application/x-www-form-urlencoded"; CanonicalHeaders_line2 = "host:ec2.amazonaws.com"; CanonicalHeaders_line3 = "x-amz-date:"+CDT; // Build CanonicalRequest Request_Method = "GET"; CanonicalURI = "/"; CanonicalQueryString = "Action=DescribeRegions&Version=version"; CanonicalHeaders = CanonicalHeaders_line1 + "\n" + CanonicalHeaders_line2 + "\n" + CanonicalHeaders_line3 + "\n"; SignedHeaders_line = "content-type;host;x-amz-date"; byte[] HashedPayload_bytes = new SignString().HmacSHA256(Input.getBytes("UTF-8")); HashedPayload = new SignString().convertbyte(HashedPayload_bytes); CanonicalRequest = Request_Method + "\n" + CanonicalURI + "\n" + CanonicalQueryString + "\n" + CanonicalHeaders + "\n" + SignedHeaders_line + "\n" + HashedPayload; // Calculate String to sign Signing_algorithm = "AWS4-HMAC-SHA256"; RequestDate = CDT; CredentialScope = Day+"/"+Region+"/"+Service+"/aws4_request"; byte[] HashedCanonicalRequest_bytes = new SignString().HmacSHA256(CanonicalRequest.getBytes("UTF-8")); HashedCanonicalRequest = new SignString().convertbyte(HashedCanonicalRequest_bytes); string_to_sign = Signing_algorithm+"\n"+RequestDate+"\n"+CredentialScope+"\n"+HashedCanonicalRequest; ExecutionUtil.setDynamicProcessProperty("String_to_sign",string_to_sign, false); dataContext.storeStream(is, props); }‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍/pre p /p p2. Use the below script to calculate signature and store the signature in a dynamic process property./p pre import java.util.Properties; import java.io.InputStream; import java.lang.Byte; import com.boomi.execution.ExecutionUtil; import javax.xml.bind.DatatypeConverter; import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; import org.apache.commons.codec.binary.Base64; import org.apache.commons.codec.binary.Hex; import java.security.MessageDigest; String String_to_sign= ExecutionUtil.getDynamicProcessProperty("String_to_sign"); Day = ExecutionUtil.getDynamicProcessProperty("Date"); Region = ExecutionUtil.getDynamicProcessProperty("Region"); Service = ExecutionUtil.getDynamicProcessProperty("Service"); String secret_key = ExecutionUtil.getDynamicProcessProperty("SecretKey"); // Create a signing key. byte[] signing_key = new CalculateSignature().getSignatureKey(secret_key, Day, Region, Service); // Use the signing key to sign the StringToSign using HMAC-SHA256 signing algorithm. byte[] signature_bytes = new CalculateSignature().HmacSHA256(String_to_sign, signing_key); String signature = new CalculateSignature().convertbyte(signature_bytes); String signature1 = new CalculateSignature().convertbyte(signing_key); public class CalculateSignature{ public static byte[] getSignatureKey(String key, String dateStamp, String regionName, String serviceName) { byte[] kSecret = ("AWS4" + key).getBytes("utf-8"); byte[] kDate = HmacSHA256(dateStamp, kSecret); byte[] kRegion = HmacSHA256(regionName, kDate); byte[] kService = HmacSHA256(serviceName, kRegion); byte[] kSigning = HmacSHA256("aws4_request", kService); return kSigning; } public static byte[] HmacSHA256(String data, byte[] key) { Mac mac = Mac.getInstance("HmacSHA256"); SecretKeySpec secretKeySpec = new SecretKeySpec(key, "HmacSHA256") mac.init(secretKeySpec); return mac.doFinal(data.getBytes("utf-8")); } public static String convertbyte(byte[] bytes) { StringBuffer hexString = ne

Answer (1 of 2): HTTPS and SHTTP both are not same. However, both offer enhanced security over HTTP. SHTTP (Secure Hypertext Transmission Protocol) is more advanced version of HTTP that provide security through encryption. HTTPS (Hypertext Transmission Protocol Secure) is normal HTTP over SSL/T...

In the time it takes to read this sentence, the AWS Identity and Access Management (IAM) service will handle several billion requests. Pretty close to every one of those requests is authenticated using the AWS SIGv4 protocol, before IAM authorization policy is applied to check if the request is allo

Public cloud is no longer the bright new shiny toy, but it paved the way for XaaS, Edge, and a new cycle of innovation.