Senior LevelAuthentication & Authorization
What is HAWK HTTP Authentication and how does MAC-based request signing work without public key crypto?
❓ Interview Prompt: Explain HAWK HTTP authentication protocol, symmetric MAC request signing, payload validation, and replay defense.
HAWK is an HTTP authentication protocol that enables clients to make authenticated requests using a symmetric Message Authentication Code (MAC) secret, providing cryptographic request signing without public key overhead.
How HAWK Works:
1
Shared Key Credentials: Client and server share a symmetric key ID ('id') and key secret ('key').
2
MAC Calculation: For each request, the client computes an HMAC signature over HTTP Method, Request Path, Host, Port, Timestamp, and Nonce:
$$\text{MAC} = \text{HMAC-SHA256}(\text{NormalizedHeaderString}, \text{key})$$
3
Header Transmission: Client sends header: 'Authorization: Hawk id="dh37fg3h", ts="1353832234", nonce="j4553d", mac="667f..."'
4
Benefit: Verifies full HTTP request integrity and identity using ultra-fast symmetric HMAC operations.
Code Implementation Example
typescript
import hawk from '@hapi/hawk';
// Server-side verification of incoming HAWK authenticated HTTP request
async function authenticateHawkRequest(req: Request) {
const credentialsFunc = async (id: string) => {
const keyRecord = await db.apiKeys.find(id);
return { key: keyRecord.secret, algorithm: 'sha256', user: keyRecord.userId };
};
// Verifies signature, timestamp window, and nonce reuse automatically
const { credentials } = await hawk.server.authenticate(req, credentialsFunc);
return credentials.user;
}💡Server-side verification of incoming HAWK HTTP request signature.
🎯 Interview Key Takeaway
HAWK uses symmetric HMAC request signing over path, timestamp, and nonce to verify HTTP request integrity without public key crypto.
#HAWK#MAC#Request Signing#HTTP Auth#Senior
Back to all Authentication & Authorization Questions→