Hrithik.Security.Pro 1.0.1

🔐 Commercial License

Hrithik.Security.Pro requires a paid commercial license.

💳 Purchase

🌍 International Customers

Pay securely via PayPal (USD $99 – yearly license):

👉 https://paypal.me/hrithikkalra/99

🇮🇳 Indian Customers

Please email hrithikkalra11@gmail.com to receive UPI / bank transfer payment options.

📩 License Activation

After payment, please email the following details to hrithikkalra11@gmail.com:

• Payment confirmation (PayPal transaction ID or payment reference)
• Company name
• Domain / Application name

You will receive your license key and shared secret within 24 hours.

Licenses are issued per company / per application, are non-transferable, and are valid for 12 months from the date of issue.

🔐 Commercial Feature (Pro)

Client-side request signing is available only in Hrithik.Security.Pro and requires a valid commercial license.

Client-Side Request Signing (Pro)

Hrithik.Security.Pro uses cryptographically signed requests to protect APIs from replay attacks, forged requests, and delayed replays.

This document explains how client applications must generate the required headers when calling a Pro-protected API.

🚀 Why Pro?

Hrithik.Security.Pro is designed for production APIs where tamper-proof requests, replay protection, and client authentication are business-critical (payments, fintech, internal services).

🔐 Required Headers (Pro)

Each HTTP request MUST include the following headers:

Requests missing any of these headers will be rejected.

⏱ Timestamp Rules

• Timestamp must be UTC
• Default allowed clock skew: ±2 minutes (configurable server-side)
• Requests outside the allowed window are rejected

Ensure client machines are time-synced (NTP recommended).

🔑 Signature Algorithm

The request signature is calculated as:

HMACSHA256( METHOD + PATH + BODY_HASH + TIMESTAMP, SHARED_SECRET )

Where:

• METHOD → HTTP method (GET, POST, etc.)
• PATH → Request path (example: /api/orders)
• BODY_HASH → SHA256 hash of the request body
• TIMESTAMP → Unix timestamp (UTC seconds)
• SHARED_SECRET → Secret issued with your Pro license

Important Notes

• The signature must be hex-encoded (uppercase)
• For requests without a body (e.g. GET), use an empty string ("") when calculating BODY_HASH

🧪 Example (C# Client)

using System.Net.Http;
using System.Security.Cryptography;
using System.Text;

static string ComputeSha256(string input)
{
    using var sha = SHA256.Create();
    return Convert.ToHexString(
        sha.ComputeHash(Encoding.UTF8.GetBytes(input)));
}

static string ComputeSignature(
    string method,
    string path,
    string body,
    string timestamp,
    string secret)
{
    var bodyHash = ComputeSha256(body ?? string.Empty);
    var payload = method + path + bodyHash + timestamp;

    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    return Convert.ToHexString(
        hmac.ComputeHash(Encoding.UTF8.GetBytes(payload)));
}

// --------------------
// Usage
// --------------------

var secret = "YOUR_SHARED_SECRET";
var body = "{ \"amount\": 100 }";
var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();

var signature = ComputeSignature(
    "POST",
    "/api/payments",
    body,
    timestamp,
    secret);

var request = new HttpRequestMessage(
    HttpMethod.Post,
    "https://api.example.com/api/payments");

request.Content = new StringContent(body, Encoding.UTF8, "application/json");

request.Headers.Add("X-Request-Id", Guid.NewGuid().ToString());
request.Headers.Add("X-Request-Timestamp", timestamp);
request.Headers.Add("X-Request-Signature", signature);

## ❌ Common Errors

| Error | Cause |
|------|------|
| Invalid signature | Wrong secret or payload mismatch |
| Expired timestamp | Client clock not in sync |
| Replay detected | Same `X-Request-Id` reused |
| Missing headers | Pro signing not applied |


## 🧠 Security Notes

Never hardcode the shared secret in frontend applications

Store secrets securely (environment variables, Azure Key Vault, etc.)

Rotate secrets periodically

Each application should use a unique secret

## 💳 Getting a Pro License

See **Commercial License** section above for purchase and activation details.

## 📞 Support

For questions related to:

Request signing

License activation

Configuration

Contact:

📧 hrithikkalra11@gmail.com