transloadit / transloadit/node-sdk
Enforce SHA-384 signatures in Node SDK
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 73
- Forks
- 26
- Avg merge
- 10h 51m
- Merged PRs (30d)
- 18
Description
Problem
Our API keys default to sha384 signatures, but the SDK's private _calcSignature() currently accepts an algorithm argument. That makes it possible for consumers (or downstream wrappers) to generate sha1 signatures from the SDK surface, which can fail against accounts/keys configured for sha384 and causes avoidable auth failures.
Expected behavior
The SDK should consistently generate sha384 signatures for signed requests.
Proposed fix
- Remove algorithm override support from
_calcSignature()and always sign withsha384. - Add a regression test to ensure we keep emitting
sha384even if an extra algorithm argument is passed. - Document in README that
calcSignature()returnssha384signatures.
Context
This aligns SDK behavior with modern API key defaults and avoids signature-algorithm drift in downstream integrations.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate _calcSignature() and the public calcSignature() entry point, then inspect the existing signature tests and README. Confirm the current algorithm handling and add coverage for an extra algorithm argument; done means signed requests and documented calcSignature() behavior consistently use sha384.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- api, authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100