Implement wopi proof keys mechanism - #416
Open
lunika wants to merge 3 commits into
Open
Conversation
lunika
commented
Nov 24, 2025
Comment on lines
+46
to
+56
| def build_rsa_public_key(modulus, exponent): | ||
| """Build RSA public key from modulus and exponent.""" | ||
| mod = int(b64decode(modulus).hex(), 16) | ||
| exp = int(b64decode(exponent).hex(), 16) | ||
|
|
||
| rsa_public_key = RSAPublicNumbers(exp, mod).public_key() | ||
|
|
||
| return rsa_public_key.public_bytes( | ||
| encoding=serialization.Encoding.PEM, | ||
| format=serialization.PublicFormat.SubjectPublicKeyInfo, | ||
| ) |
Member
Author
There was a problem hiding this comment.
Here I hesitate a lot between saving the modulus and exponent in redis and rebuild the key each time I need it or save it in a PEM format. PEM format take much more space and I don't know if it's faster to load a public key in PEM format or build it from its exponent and modulus
lunika
force-pushed
the
wopi/proof_keys
branch
from
December 10, 2025 08:04
6980bf8 to
2b0bac1
Compare
NathanVss
approved these changes
Dec 10, 2025
NathanVss
left a comment
NathanVss
left a comment
Contributor
There was a problem hiding this comment.
LGTM! What is the intention behind the case where the old pk verifies the signature but not the current one?
| item = request.auth.item | ||
| abilities = item.get_abilities(request.user) | ||
|
|
||
| self._verify_request_signature(request) |
Contributor
There was a problem hiding this comment.
I can see that this call is made on only few actions, why ? Is it because the standard only expect some actions to be signed ?
lunika
force-pushed
the
wopi/proof_keys
branch
from
December 30, 2025 10:28
2b0bac1 to
9b88584
Compare
|
Member
Author
|
@kernicPanel You should finish this PR, this is a missing part in the WOPI implementation. |
kernicPanel
force-pushed
the
wopi/proof_keys
branch
2 times, most recently
from
July 15, 2026 10:50
711080a to
bca6859
Compare
kernicPanel
force-pushed
the
wopi/proof_keys
branch
from
July 22, 2026 06:57
bca6859 to
2d98857
Compare
kernicPanel
changed the base branch from
main
to
fix/security-dependency-updates
July 22, 2026 06:57
kernicPanel
force-pushed
the
wopi/proof_keys
branch
from
July 22, 2026 07:17
2d98857 to
08bfcac
Compare
Base automatically changed from
fix/security-dependency-updates
to
fix/dockerfile-hardening
July 22, 2026 13:22
Base automatically changed from
fix/dockerfile-hardening
to
fix/pin-collabora-image
July 22, 2026 13:22
kernicPanel
force-pushed
the
fix/pin-collabora-image
branch
from
July 22, 2026 13:45
651a643 to
d2c1e47
Compare
2 tasks
kernicPanel
force-pushed
the
wopi/proof_keys
branch
2 times, most recently
from
August 7, 2026 08:45
84a968e to
88aca18
Compare
The proof-key feature is not yet implemented. The first step is to save the proof-key given by the client in its discovery document.
in order to validate a WOPI signature, if the client has defined proof keys, we need several tools to implement the algo defined in this [documentation][1] [1]: https://learn.microsoft.com/en-us/microsoft-365/ cloud-storage-partner-program/online/scenarios/proofkeys
We can now implement the logic to verify a wopi request signature. If a wopi configuration have proof keys then the request must provide a signature and a valid timestamp.
kernicPanel
force-pushed
the
wopi/proof_keys
branch
from
August 13, 2026 07:22
88aca18 to
8a0dd2a
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
The wopi specs provide a documentation explaining how to verify that a wopi request provides from a trusted wopi client.
This documentation is available here https://learn.microsoft.com/en-us/microsoft-365/cloud-storage-partner-program/online/scenarios/proofkeys
We have first to save wopi proof keys if present in the discovery xml than use them to validate the signature provided in the request.
Proposal