question

ethan avatar image
ethan asked

Alexa skill certification: error The skill end-point is not validating the signatures for incoming requests and is accepting requests with an empty signature URL

Hi everbody, I 'm going through the certification process for an Alexa Skill. I receive the error above mentioned. My endpoint runs on an Heroku app, when an Alexa request is sent to that endpoint, it triggers an http request to a remote web service. I 've checked and have turned on SSL Certificate on heroku app but keep receiving this message. I got it that there's something related the signature of the request but don't understand how to fix this problem. Any suggestions? Thanks in advance

This is the code:

const options = {

hostname: ‘xx.xx.xx.xx’,

port: 8080,

path: '/path/to/service?searchText=',

method: 'POST',

headers: { 'Content-Type': 'application/json', 'Cookie':'' }

};

var server = http.createServer(app);

var port = process.env.PORT || 3000; server.listen(port, function () {

console.log("Server is up and running on port 3000...");

});

alexaRouter.post('/callAVA', function (req, res) {

bot=req.query.ava; callAva(req,res); });

function callAva(req, resp){

let strRicerca='';

let data='';

let strOutput='';

let sessionId = req.body.session.sessionId; l

let request = req.body.request; //per slot

let boolEndSession=false;

if (req.body.request.type === 'LaunchRequest') { strRicerca='zzzstart'; }

else if (req.body.request.type === 'IntentRequest' && req.body.request.intent.name === 'AnyText') { strRicerca=utf8.encode(request.intent.slots.searchText.value);

strRicerca = querystring.escape(strRicerca); }

else if (req.body.request.type === 'IntentRequest' && req.body.request.intent.name === 'AMAZON.HelpIntent') { strRicerca='zzzhelp'; }

else if (req.body.request.type === 'IntentRequest' && req.body.request.intent.name === 'AMAZON.StopIntent') { strRicerca='zzzstop'; boolEndSession=true; }

else if (req.body.request.type === 'IntentRequest' && req.body.request.intent.name === 'AMAZON.CancelIntent') { strRicerca='zzzcancel'; }

else if (req.body.request.type === 'SessionEndedRequest') { strRicerca='zzzEndSession'; }

else if (req.body.request.intent.name === 'AMAZON.FallbackIntent') { strRicerca='zzzNoResponse'; } else if (req.body.request.intent.name === 'AMAZON.NavigateHomeIntent') { strRicerca='zzznavigatehome'; }

if(strRicerca) {

options.path+=strRicerca+'&user=&pwd=&ava='+bot; }

var ss=leggiSessione(__dirname +'/sessions/', sessionId); if (ss===''){ options.headers.Cookie='JSESSIONID='; }

else { options.headers.Cookie='JSESSIONID='+ss; }

var req1 = http.request(options, (res) => { if (res.headers["set-cookie"]){

var x = res.headers["set-cookie"].toString(); var arr=x.split(';') var y=arr[0].split('='); scriviSessione(__dirname+'/sessions/',sessionId, y[1]); } res.setEncoding('utf8'); res.on('data', (chunk) => { data += chunk; let c=JSON.parse(data); strOutput=c.output[0].output; strOutput=strOutput.replace(/(<\/p>|<p>|<b>|<\/b>|<br>|<\/br>|<strong>|<\/strong>|<div>|<\/div>|<ul>|<li>|<\/ul>|<\/li>| |)/gi, ''); resp.json({ "version": "1.0", "response": { "shouldEndSession": boolEndSession, "outputSpeech": { "type": "PlainText", "text": strOutput } } }); }); res.on('end', () => { options.path='/AVA/rest/searchService/search_2?searchText='; }); }); req1.on('error', (e) => { strOutput="si è verificato errore " + e.message; }); req1.write(postData); req1.end(); };

certificationcertificatesignature
10 |5000

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Amazon_Bernardo Bezerra avatar image
Amazon_Bernardo Bezerra answered

Hello @ethan and thank you for posting.

This page has the requisites necessaries to host your skill as a web service. Please check if your configuration fulfills those.

Regards,
Barry

10 |5000

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

newuser-cb8d2c7e-982c-4c8f-a1d9-95a15a63157b avatar image
newuser-cb8d2c7e-982c-4c8f-a1d9-95a15a63157b answered

hello @ethan are your issues resolved because I am facing the same problem. I would really appreciate your help.Thanks.

1 comment
10 |5000

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Amazon_Bernardo Bezerra avatar image Amazon_Bernardo Bezerra ♦♦ commented ·

Hello and thank you for your message.

Have you checked the documentation on this link? Can you please share the specifics on what sort of issues you are facing?

Regards,
Barry

0 Likes 0 ·
Igor Belagorudsky avatar image
Igor Belagorudsky answered

I just lost a couple hours on this until I found this little comment - https://developer.amazon.com/en-US/docs/alexa/custom-skills/host-a-custom-skill-as-a-web-service.html#manually-verify-request-sent-by-alexa. I was returning a 401 but it's looking for exactly 400 as the error code. I changed it and the validation passed. Hope this helps someone in the future.

10 |5000

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Clelio Quattrocchi avatar image
Clelio Quattrocchi answered

I have the same issues.

On first run of certification I had 4 fix required because I forgot to implement signature/timestamp verification. So I have fixed the issue and installed it but nothing is changed. Despite my webservice return 400 BAD request, Alexa certification highlight the same 4 fix.

The skill end-point is not validating the signatures for incoming requests and is accepting requests with an empty signature URL.

The skill end-point is not validating the signatures for incoming requests and is accepting requests with an incorrect certificate URL.

The skill end-point is not validating the signatures for incoming requests and is accepting requests with an invalid signature URL specified.

The skill end-point is not validating the signatures for incoming requests and is accepting requests when no signature URL headers are specified.

I tested on my local and my web service retunr 400 if signaturecertchainurl missed or contains wrong value

Any suggestion?

I saw other threads in the forum but nobody is able to answer

10 |5000

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.