如何在javascript中的嵌套对象中对键的顺序进行排序？

Question

the problem is: I have a request with params like:

{ "foo": "bar", "bar": "baz", "baz" : { "nestedKey": "foo" } }

I need to sign it with Hmac512 algorithm, so I'll need to stringify the object first.

But, my concern is, if the order of the key isn't preserved, the signature generated by server and the client could be different.

to handle that, my idea is simply to order the keys of the object (including the keys nested inside that object).

how can I achieve this?

Answer 1

As stated in the OP, the input to the HMAC process must be deterministic.

But Javascript object elements' order cannot be set, no matter how much we'd like them to be settable. (I see this question re-occur every so often.)

Answer is to sort the the stringified string itself.

See json-stable-stringify for a solution.

Then feed the resulting string into the HMAC method. No need to base64 encode it.

Answer 2

You need to ensure that the message is the same in both sides, but you should not need to modify or adapt the message at all

Basically apply this algorithm

 base64(sign(utf8(json message)))

Client side

1. Stringify: Convert the javascript object to string

2. UTF-8: Ensure you are using a known and fixed encoding like utf

3. Sign: Calculate HMAC over the resulting message

4. base64: Convert the binary signature to base64

Send to client the json message and the signature

Server side

Get the raw message from client and apply steps 2-4. Check if the signatures are equal