How signed requests between Lummet and its brands work

Each call from the control plane to a brand proves three things: who sent it, that it was not changed on the way, and that it is not a replay of an earlier call.

What is signed

The signature is an HMAC-SHA-256 over five values joined together: the HTTP method, the path, a timestamp, a random one-time value and a SHA-256 hash of the request body. The secret used to sign is unique to each brand.

What the brand checks

The brand recomputes the signature from what it received and compares it with the one supplied. A different body, path, method or secret produces a different signature, so the request is rejected.

Where the secret lives

On the control plane side, the secret is stored encrypted with AES-GCM, and the key that decrypts it is held as a Worker secret rather than in the database. Someone who obtained a copy of the database alone could not recover a brand's secret.