Btukfyl

for the authentication of my Node Server (Express JS) with another API a separate header must be sent within the POST request.

Quote from the documentation:

You need to send a X-Authorization-Ahoi header with this request. The
header value is an encoded JSON string that consists of the
<INSTALLATION_ID>, a random 16-character string as nonce and the
current date in ISO 8601 format.

Example from the documentation:

{

    "installationId":"<INSTALLATION_ID>",

    "nonce":"0wYWLarLDBrWU7B2I1Go4A==",

    "timestamp":"2018-11-01T11:32:44.413Z"

}

In the documentation of the API the following Java example is given which I try to reproduce in Javascript.

String installationId = <INSTALLATION_ID>;

// create nonce

byte nonce = new byte[16];

SecureRandom.getInstanceStrong().nextBytes(nonce);

String nonceBase64Enc = Base64.getEncoder().encodeToString(nonce);

// create timestamp

String timeStr = Instant.now().toString();

// create json string

String xAuthAhoiJson = String.format("{"installationId":"%s","nonce":"%s","timestamp":"%s"}",

                                        installationId, nonceBase64Enc, timeStr);

// encode encrypted header value

String XAUTH_AHOI_BASE64_URL_ENC = Base64.getUrlEncoder().withoutPadding()

                                         .encodeToString(xAuthAhoiJson.getBytes( StandardCharsets.UTF_8 ));

Here's what I've been trying to do:

const installationId = '<EXAMPLE_INSTALLATIONID>';



const nonce_tmp = crypto.randomBytes(16);

const nonce = nonce_tmp.toString('base64');



const date = new Date();

const timestamp = date.toISOString();



const  xAuthAhoiJson = JSON.stringify({installationId, nonce, timestamp});



const XAUTH_AHOI_BASE64_URL_ENC = base64url.encode(xAuthAhoiJson);



const url = 'https://banking-sandbox.starfinanz.de/auth/v1/oauth/token?grant_type=client_credentials';

        const options =  { headers: 

                          { 'Authorization': 'Basic ' + Buffer.from(credentials).toString('base64'),

                            'X-Authorization-Ahoi': XAUTH_AHOI_BASE64_URL_ENC }

                         };

request.post(url, options, function (e, r, b) { console.log(b); });

For the POST request I use the request-package.
For the encoding in Base64 URL Safe I use the base64url-package.
When executing the POST request I get the following message:

{

"timestamp": 1543229480764,

"status": 400,

"error": "Bad Request",

"message": "Nonce is invalid.",

"path": "/auth/v1/oauth/token"

}

Now my question is: What is wrong with creating my Nonce and how do I fix it?
Or is it the API I'm sending the POST request to?

You just forgot to convert the nonceBase64Enc to string. You have done that in java but not in javascript.

Just add the .toString('hex'); at the end of nonceBase64Enc

Example : const nonceBase64Enc = Buffer.from(nonce, 'base64').toString('hex');

You are done now! 🎉🍾