Amazon HMAC with ColdFusion

I recently received a work request to update our calls that we were making against Amazon's Web Services with a new authentication signature. This proved to be more complicated that it should have been. I thought I would share my experience, in hope that it will help remove a headache for someone else out there.

The purpose was to "sign" your requests with a secret key so Amazon could verify that the request had not been altered in transit (these are requests that are transmitted via REST calls (http). There have been questions about why this was needed. The biggest point of abuse that I can think of comes from the use of these webservices from a client side (AJAX) - or doing a DOS against another competitor since you can only make so many requests per minute. Of course, now AJAX calls will need to be designed so the secret key never ever ever get exposed to the client side.

Here is the "documentation" Amazon provided. They gave this Important note to us:
"You have until August 15, 2009 to authenticate requests sent to the Product Advertising API. After August 15, 2009, messages that aren't authenticated will be denied."
What they failed to mention was their "testing" schedule (aka planned outages) which was sent (and forwarded to me just a few days ago).
Here is the full schedule:

"These planned outages will help our developers test their signed requests implementation and also discover applications and code paths that they may have missed, giving them the opportunity to address these gaps before signed requests become mandatory on August 15."

• Monday, Aug 3 at 2PM (ET) through Tuesday, Aug 4 at 2PM, a few requests (appx 20% of the requests) that do not implement this new method correctly will be rejected.
• Monday Aug 10 from 2PM (ET) through 4PM, all requests that do not implement this new method correctly will be rejected.

Uhh, sorry what? Planned production outage 2 weeks earlier?!! Needless to say this led to an elevated blood pressure for many. I looked at some of the Sample REST requests, found some HMAC code already available on RIA Forge in several "amazon" related projects and thought "This will be easy enough".

Its not that it wasn't easy to reproduce the example they gave. That part WAS easy. The difficult / frustrating part was getting the REAL requests signed and authenticated. The good news for many is that you can simply check the status code of your original request and make it again if it has failed during this first round that lasts 24 hours and you will likely be fine.

Here is a checklist of what I would suggest looking at if you are having problems, this is from my own experiences and is bound to help someone. As I receive feedback, I'll update accordingly.

1. Make sure you are using your OWN secret key.
   
2. Use http://ecs.amazonaws.com - NOT http://webservices.amazon.com
3. Do NOT use a trailing slash at the end of /onca/xml?...
4. DO NOT put line breaks in your query string. Just use the normal & to separate your params.
5. Make sure you are only doing a line break chr(10) like the following:
   'GET' & chr(10) & 'ecs.amazonaws.com' & chr(10) & '/onca/xml' & chr(10) & '#YourQueryStringHERE#'

For me, the big epiphany was after using the webservices URL, one type of responseGroup would work, but another would not. The error was coming from ecs.amazonaws.com, even though I was making my calls to webservices.amazon.com, just like their example.

Here is an example of the code that I used.

Tag Context

Update: I had a formatting issue in the code example.

I found this method handy when trying to track down the tab Context of a page's execution. This throws an error, catches it and allows you to output (or email ... or post to a log) the needed information of where a page's execution is coming from.

<cftry>
<cfthrow>
<cfcatch>
<cfset e=duplicate(cfcatch)>
<cfdump var="#e.tagContext#">
</cfcatch>
</cftry>

One word of caution though, in my experience, it can over time (several days of try/throw/catching errors) lead to server instability. In my case, it was sending an email in the catch and was left in even after I fixed the issue to monitor / make sure it was fixed. The error you will see is:

An exception occurred when setting up mail server parameters.
This exception was caused by: coldfusion.mail.MailSessionException

For some reason it loses the connection to the mail server and ANY code that tries to send an email will fail. Not good. It was handy and served its purpose, but be warned on your method of implementation.

FFF CSS Menus Over Flex, Flash and Flash Forms

Recently I came across the issue where I needed to change from an old menu design to a CSS drop-down menu. (Similar to the way File, Edit .... Help works).
The main application was Flash based content - which presented me with a problem. The issue is that the CSS content drops behind the flash content.

Fortunately, the solution is easier than I thought.

Add This to your Object tag:

<param name="wmode" value="transparent" />

If you use version detection, make sure you add it in there. It will look something like this:

AC_FL_RunContent(
...
"wmode","transparent",
...

If you still have Flash Forms for ColdFusion laying around, just add the following to your CFFORM tag:
wmode="transparent" (note that this goes in the tag, along with your format="flash" attribute.)

If others know of pitfalls or have a sexier solution, by all means - share. :)

CFML to be Open Source (for Blue Dragon)

Blue Dragon (A CFML server similar to Adobe's ColdFusion Server) has announced a dual-license where the basic CFML based Blue Dragon server will be open source. This is smilar to the way MySQL is! This means that for those who want to "pop the hood" and customize it (like Google did for their database) - they can.

I'll let you read details there, but the first code drop will be released "near" June 2008 - same time as CF United 2008!

There is no word yet as to whether this changes anything for Adobe, but in my mind, choices are a GOOD thing. Since the source code has not been released yet, right now this doesn't mean much (IMHO) other than a PR move for New Atlanta / Blue Dragon. Still, I will certainly be downloading and popping that hood myself when the option comes.

Updated: 03/14/2008 - Clarify what this means for the CF Community.

Excel file with CFcontent

It is extremely easy to give your customers access to an Excel file containing their data.

The key is a nicely formatted HTML table, with correctly placed cfheader/cfcontent tags.
Consider the following example:

<cfsetting showdebugoutput="no">
<cfheader name="Content-Disposition" value="attachment;filename=""My File Name.xls""">
<cfcontent type="application/msexcel;charset=utf-16">
<table>
<tr>
<th>Color</th>
<th>Code</th>
</tr>
<tr>
<td>red</td>
<td>#ff0000</td>
</tr>
<tr>
<td>green</td>
<td>#00ff00</td>
</tr>
<tr>
<td>blue</td>
<td>#0000ff</td>
</tr>
</table>
<cfabort>


If you have any other tips or ideas feel free to share them!

Barcodes in ColdFusion

One of the brilliant minds that I have the pleasure to work with at CF WebTools, Ryan, has just released information on generating and reading 2D barcodes in ColdFusion. I won't steal his thunder by writing about it in too much detail here, read about it at Stillnet Studios.
I believe this example needs ColdFusion 8, but please post back if anyone has accomplished this with earlier versions, we'd love to see the CFC extended!

Thank you Ryan for sharing this with us!

ColdFusion 8 hotfix 2

I just realized that ColdFusion 8 hotfix 2 is now available! Details there.

This is typical - I just did a new install of a download from Monday.

Now back to your regularly scheduled development.