Products · Security
Verification & Troubleshooting
What encryption does and doesn't prove, and how to fix common decryption and reply failures.
Requests aren't signed
Encryption keeps the request private, but it doesn't prove who sent it. Your public key is public, so anyone who knows your URL can send a request your server will decrypt. To stay safe:
- Treat
flowDataandexportedDataas untrusted input. - Before you move money or change an account, check the facts on your side, such as a payment's status in your own records.
- Keep exchange URLs out of public code and logs.
RSA settings by language
Monime uses RSA-OAEP with SHA-256 for both the OAEP hash and MGF1. Getting this wrong is the most common cause of failed decryption.
| Language | Works with the defaults? | What to do |
|---|---|---|
| Node.js | Yes | oaepHash: "sha256" sets both hashes |
| Python | Yes | Pass SHA-256 for both in OAEP() |
| Go | Yes | rsa.DecryptOAEP(sha256.New(), ...) uses SHA-256 for both |
| Java | No | Set MGF1ParameterSpec.SHA256 through OAEPParameterSpec |
| PHP | No | Use phpseclib v3 instead of openssl_private_decrypt |
Fixes
If you're still stuck, email [email protected] with your flow's name and the error your server logs. Don't send your private key.
Keep reading
Encryption ModelHow requests to your exchange and dynamic URLs, and your server's replies, are encrypted.Key SetupMake an RSA key pair, add the public key to your flow, and store, scope and rotate your keys.Decrypting & RespondingServer code to decrypt a request from Monime and encrypt your reply, step by step and as a full handler.Testing Your ImplementationCheck your encryption end to end with Monime's open-source reference servers in Node.js, Python, Go, Java and PHP.