Post request including headers (migrating from PHP to Lazarus) lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- torbente · 2018-01-25 13:07 Im trying to migrate a web api (coded in PHP) to lazarus, to make it stand alone, faster and secure. Almost all functions are already recoded, but i have a hard job with this issue. There are some know data: - A private key, ie ='xxxxxxx'; - a secret paraphrase, ie = 'yyyyyyy'; - And array containing the data to be post; this must include a nonce. I need: - Use the the Secret as a passphrase to sign the POST data in SHA512 encryption. -  Send the Key and Sign back in HTTPS Header for Authentication Any tips or Example code? ---------------------------------------------------------------------- Leledumbo · 2018-01-25 21:31 SHA512 hash (it's one way, so it's not an encryption) is available from HashLib4Pascal, DCPCrypt or fundamentals5. The first 2 are available from online package manager. Sending custom header in TFPHTTPClient is as straightforward as calling its AddHeader method. ---------------------------------------------------------------------- torbente · 2018-01-26 01:47 This is what i have right now. 1- Im unable to make this function works if the URL is HTTPS. I instealled OpenSSL but it do not works yet. Probably something im not doing well. Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i function ReadURLGet(url:string):string;beginwith TFPHTTPClient.Create(nil) dotry  ReadURL:= Get(url);finally  Free;end;end; 2- I installed DCPCrypt  and read the few documentation i found, but i really dont have idea how i can hash sha512 a string with a given key) 3- This is the "not-Working-yet" function im creating to send post request to HTTPS URLs. Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i [code=pascal]function PostRequest(postdata:String):String;var  FPHTTPClient: TFPHTTPClient;  ResultPost, Nonce, Sign: String;BeginNonce:=IntToStr(DateTimeToUnix(Now));Postdata := postdata+'&nonce='+Nonce;Sign = GetSignature(Secret,Postdata); // function yet to be developed. Secret is a CONSTFPHTTPClient := TFPHTTPClient.Create(nil);FPHTTPClient.AllowRedirect := True;// ADD HEADERS; PrivateKey (global CONST) and Sign   try      ResultPost := FPHTTPClient.SimpleFormPost('http://localhost/lazarus.php', Postdata); // test URL, real one is HTTPS      PostRequest := ResultPost;   except      on E: exception do         ShowMessage(E.Message);   end;FPHTTPClient.Free;end; [/code] Any help at this point? ---------------------------------------------------------------------- balazsszekely · 2018-01-26 05:45 First add dcpcrypt to required packages(Project Inspector), then: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i uses DCPsha512; function StringToSHA512(const AText: String): String;var  SHA512: TDCP_sha512;  AB: array[0..63] of byte;  I: Integer;begin  Result := '';  SHA512 := TDCP_sha512.Create(nil);  try    SHA512.Init;    SHA512.UpdateStr(AText);    SHA512.Final(AB);    for I := 0 to 63 do      Result := Result + IntToHex(AB[i], 2);  finally    SHA512.Free;  end;end; procedure TForm1.Button1Click(Sender: TObject);begin   Edit1.Text := StringToSHA512('torbente');end; Double check the result here: https://passwordsgenerator.net/sha512-hash-generator/ ---------------------------------------------------------------------- torbente · 2018-01-26 12:48 @GetMem It is a good start for the function GetSignature. But your function do not uses the secret phrase to hash the given string (post_data). The php function that makes this is: Code: PHP  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i $sign = hash_hmac('sha512', $post_data, $secret); And this is its documentation: http://php.net/manual/en/function.hash-hmac.php Do yo know a good place to get some documentation of dcpcrypt ? ---------------------------------------------------------------------- balazsszekely · 2018-01-26 15:44 QuoteIt is a good start for the function GetSignature. But your function do not uses the secret phrase to hash the given string (post_data).What prevented you to implement it?  Again check the result here(salt can be added in the input options): http://www.convertstring.com/Hash/SHA512 Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i function StringToSHA512(const AText, AKey: String): String;var  SHA512: TDCP_sha512;  AB: array[0..63] of byte;  I: Integer;begin  Result := '';  SHA512 := TDCP_sha512.Create(nil);  try    SHA512.Init;    SHA512.UpdateStr(AText + AKey);    SHA512.Final(AB);    for I := 0 to 63 do      Result := Result + IntToHex(AB[i], 2);  finally    SHA512.Free;  end;end; procedure TForm1.Button1Click(Sender: TObject);begin  Edit1.Text := StringToSHA512('torbente', 'torbentesalt');end;