"In case UPI API Gateway declines the transaction, UPI API Gateway returns a response with the HTTP Status Code 401 (Unauthorized access), and the response body contains only a Message Response object as below:
{"MsgResponse": {"responseCode": "E0", "responseMsg": "Unauthorized access" }}
But the "Demo project of JWE/JWS" can verify the signature successfully."
The high probability is that there are some errors in the JWS Protected Header. It is recommended to check whether the JWS Protected Header complies with the specification. For example: UPI-TIMESTAMP format is unix timestamp +/-300 seconds.
"UPI- REQPATH" is the same as service URL suffix. For example, the service URL suffix of SaaS Card Issuing Service Platform for App Gateway Exchange rate inquiry is "/scis/switch/exchangerateinquiry".
Must strictly follow the Security Requirements described in UPI Server-based API General Requirements.
The problem with Base64 is that it contains the characters +, /, and =, which have a reserved meaning in some filesystem names and URLs. So base64url solves this by replacing + with - and / with _. The trailing padding character = can be eliminated when not needed, but in a URL it would instead most likely be % URL encoded. Then the encoded data can be included in a URL without problems.
You should use Base64url to encode, otherwise we cannot successfully parse your request.
I successfully verified the signature locally by using a JWS-compliant library. But API Gateway still returned a response with the HTTP Status Code 401 (Unauthorized access).
For Java Developers, we provided Jar file that can be used in signature, encryption, verification, and decryption. For developers using other programming languages, using a dependency library that supports our reference specification can help you get a pleasant development experience.
Tester's Public key and Private key download from Unionpayintl Developer Platform are PKCS1 Key. Please convert PKCS1 key to pkcs8 format in order to import it from Demo project of JWE/JWS. Try using following command:
> openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in PKCS1_filename -out PKCS8_filename
First create a RFC7515 signature string. The composition of the signature is shown below:
BASE64URL(UTF8(JWS Protected Header))+'.' +BASE64URL(JWS Payload)+'.' +BASE64URL(JWS Signature)
Please try to remove BASE64URL(JWS Payload), and then use BASE64URL(UTF8(JWS Protected Header)) + '..' +BASE64URL(JWS Signature) as your signature.
Kindly Reminder