I have worked on multiple different methods of verifying the legitimacy of Roblox HTTP requests, and as a developer on the platform, it’s pretty tricky (and very hacky) to do.
Roblox adding a native method for verifying an HTTP request would not only drastically improve my, and others workflow, but it would also improve the reliability, speed and security of any existing methods out there.
One could argue that you can “have a private API key.” However, in some environments, this doesn’t always work. What if your games API key gets leaked without you knowing? By the time you find out the damage could have already been done.
I am working on my project, Devable, and it is critical that unauthorised requests that aren’t from Roblox don’t get made. For example, we whitelist games based on the game ID or account ID. This is because someone can leak their API key and allow others to use the products they have purchased (refer to https://devable.org for context). If we know for sure a request is from Roblox then we know that the place id that came with it is also legitimate and can, therefore, use it for authentication.
Roblox could provide an rbx-sig header which contains an HMAC. There could then be an API that would take this HMAC and return whether or not it is valid. The API should also return metadata like the place it came from, the job id, the place owner, etc.
Another option could be a one-time JWT token. Once again it could come in an rbx-sig header. Roblox should, again, provide an API that verifies the integrity of the JWT token and then returns the decoded version (or errors if it’s not legitimate). The JWT token could then contain the claims (and potentially custom claims defined within the Roblox game).
Defining custom claims could work like so:
local httpService = game:GetService('HttpService')
httpService:SetCustomClaims({
foo = bar
})
-- Send the request with the custom claims
-- Once decoded the server can access the custom claims
httpService:PostAsync(...)
Another method by @berezaa
I’m pretty new to the cryptography world, so please correct me if the authentication methods above wouldn’t work for this scenario and provide possible alternatives!
Thanks!
Edit: For clarification, verifying could work like this (from your end):
- Request to your server
- Server takes signature
- The server sends the signature to Roblox API for verification
- Roblox API either errors or returns claims