feature: SignatureValidation by esodot · Pull Request #2 · blockfrost/blockfrost-dart

esodot · 2025-10-08T11:15:35Z

Blockfrost webhook signature validation and verification functionality
Refactoring and dependency updates

- Blockfrost webhook signature validation and verification functionality - Refactoring and dependency updates

- Export the src/utils/blockfrost_signature_validator.dart

- Add own utils export file to control the exported files from utils folder. - Use utils_exports.dart in main export file

slowbackspace · 2025-10-08T12:31:56Z

Hi @esodot, thanks for the contribution!
Would you be interested to add usage examples to our doscs on
https://blockfrost.dev/start-building/webhooks/webhooks-signatures#using-sdk
and
https://blockfrost.dev/start-building/webhooks/using-webhooks#process-a-webhook-request

(there is a "Edit this page" button at the bottom)

There is a bounty of 100 ADA for the task blockfrost/blockfrost.dev#8 and you already did the hard part 🚀

andro-devs · 2025-10-08T13:32:52Z

Hi @slowbackspace, thank you. I'm currently preparing the usage examples for the dart SDK and will create a pull request there ASAP.

andro-devs · 2025-10-08T14:53:48Z

@slowbackspace added PR into documentation repo: blockfrost/blockfrost.dev#60

slowbackspace

Good job! Just a few changes required.
In general:

The API for the verification function should stay consistent across all SDKs (order of fn parameters, same amount of configurability, same defaults, errors on failure)
Instead of returning false, throw a custom error/exception in every failure case.

And don't forget to send your ADA address to receive the bounty once the PR is merged. Sadly there is a bounty is for the both sdk implementation and documentation so we can either send it to one address or split it between two.

slowbackspace · 2025-10-20T14:21:05Z

+import 'package:blockfrost_api/src/utils/signature_validator.dart';
+import 'package:crypto/crypto.dart';
+
+const int maxToleranceSeconds = 60;


please make this configurable by using it as a fn param in BlockfrostSignatureValidator.validate with default of 600s. It should mimic TS/Python interface as closest as possible.

https://github.com/blockfrost/blockfrost-js/blob/master/src/utils/helpers.ts#L211

slowbackspace · 2025-10-20T14:25:09Z

+/// Adapter class which implements the validator interface to validate the blockfrost webhook signature.
+class BlockfrostSignatureValidator implements SignatureValidator {
+  @override
+  bool validate({


Can you please change the order of the params to match the node.js, python and ruby SDK implementation

https://github.com/blockfrost/blockfrost-python/blob/master/blockfrost/helpers.py#L18
https://github.com/blockfrost/blockfrost-js/blob/master/src/utils/helpers.ts#L211

slowbackspace · 2025-10-20T15:11:14Z

+      providedSignatures.any((sig) => sig == expectedSignature);
+
+  if (!signatureMatch) {
+    print('Verification Failed: Signatures do not match.');


Leaking the expected HMAC = leaking an auth token for that payload+timestamp.
If anyone with log access sees the expected signature for the payload, they can replay the request within the tolerance window by sending the same body with t and v1 values from the logs.

If possible throw an error similiar to python/node.js implementation with signature header and payload attached. Don't print expected signature.
https://github.com/blockfrost/blockfrost-js/blob/master/src/utils/helpers.ts#L285-L291

slowbackspace · 2025-10-20T15:12:57Z

+  print("timeDifference: $timeDifference");
+
+  if (timeDifference > maxToleranceSeconds) {
+    print(


same as above, please throw an error instead of using print fn

- Refactor print messages. - Add SignatureValidationException. - Use signature_validation_exception.dart in main export file.

andro-devs · 2025-10-22T09:27:02Z

@slowbackspace Thank you for your review. I did the needed changes. Please review again. Also updated the PR in blockfrost.dev repo: blockfrost/blockfrost.dev#60

Regarding Bounty, please use this address:
addr1q9y86rykw0jdt0esf8g2y7y9dnp7hyp7tpwf4ez86jfzs4luw7nfzwm79hj9va6tek7nl5k2h4nu8urfvvc4wj0j5d2qq7u7ld
Thank you.

andro-devs · 2025-11-11T06:58:42Z

Hi @slowbackspace any updates?

slowbackspace

Sorry for the delay. LGTM! The 100 ADA bounty will be paid shortly.

andro-devs · 2025-12-10T10:05:46Z

if its simpler for you use the ada handle: "adam.app"

andro-devs · 2026-01-05T15:22:08Z

Sorry for the delay. LGTM! The 100 ADA bounty will be paid shortly.

Any updates here?

andro-devs · 2026-02-02T10:14:56Z

Sorry for the delay. LGTM! The 100 ADA bounty will be paid shortly.

@slowbackspace are you going to send it or not?

slowbackspace · 2026-02-02T13:23:56Z

@andro-devs sorry, it's been super busy and the payment got stuck with the accounting department for a bit. we’ve sent something extra to make up for the delay.

tx fa9ad51ace3096c65cd97bc30533ea927d3f9e55dff0a806e764f3f0c9701746

esodot and others added 4 commits October 8, 2025 12:53

feature: SignatureValidation

37679a3

- Blockfrost webhook signature validation and verification functionality - Refactoring and dependency updates

feature: SignatureValidation

bcd3b94

- Export the src/utils/blockfrost_signature_validator.dart

feature: SignatureValidation

8d0b06b

- Add own utils export file to control the exported files from utils folder. - Use utils_exports.dart in main export file

feature: SignatureValidation

d0af10d

- Add own utils export file to control the exported files from utils folder. - Use utils_exports.dart in main export file

slowbackspace requested changes Oct 20, 2025

View reviewed changes

feature: Introduce SignatureValidationException

eb1f853

- Refactor print messages. - Add SignatureValidationException. - Use signature_validation_exception.dart in main export file.

esodot requested a review from slowbackspace October 23, 2025 12:23

slowbackspace approved these changes Dec 1, 2025

View reviewed changes

Conversation

esodot commented Oct 8, 2025

Uh oh!

slowbackspace commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andro-devs commented Oct 8, 2025

Uh oh!

andro-devs commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

slowbackspace left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andro-devs commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

andro-devs commented Nov 11, 2025

Uh oh!

slowbackspace left a comment

Choose a reason for hiding this comment

Uh oh!

andro-devs commented Dec 10, 2025

Uh oh!

andro-devs commented Jan 5, 2026

Uh oh!

andro-devs commented Feb 2, 2026

Uh oh!

slowbackspace commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

slowbackspace commented Oct 8, 2025 •

edited

Loading

andro-devs commented Oct 8, 2025 •

edited

Loading

andro-devs commented Oct 22, 2025 •

edited

Loading