alexa-verifier set the "verify" flag to true and calling from a non echo throws an error about alexa-app-server

[dblock]

I'm saying that I don't know much about it, I didn't write this code or actually used it myself ;) Others like @tejashah88 or @mreinstein will know a lot more!

[dblock]

Whcih version are you using? I believe this has been fixed, try the released 2.3.1 and if that doesn't work HEAD.

[cpup22]

yea I'm on 2.3.1

Is there an easy way to use head within my node app? Or do I need to checkout the git repo and move the content into the npm_modules dir?

[dblock]

You should be able to do this in package.json:

"dependencies": {
    "alexa-app-server": "alexa-js/alexa-app-server"
}

See https://docs.npmjs.com/files/package.json#github-urls for details.

Can you please verify that this is actually fixed? We can close the issue then.

We'll release the next version shortly (see #47), after #48 is resolved.

[cpup22]

Changed my dependencies per your suggestion in the package.json file and restarted my app. Getting the same error.

[dblock]

What's in alexa-app-server/index.js:97? You can see on master that https://github.com/alexa-js/alexa-app-server/blob/master/index.js#L97 is not at all able to throw that error.

[cpup22]

you are right... I forgot to run an npm install before restarting. okay, after doing that it doesn't throw the er error I was seeing before. However, it also isn't throwing a 500 error when I try from postman and not an echo device. I get a valid response:

{
  "version": "1.0",
  "response": {
    "directives": [],
    "shouldEndSession": true,
    "card": {
      "type": "LinkAccount"
    },
    "outputSpeech": {
      "type": "SSML",
      "ssml": "<speak>Looks like you need to link your account. Please open the Alexa app for setup.</speak>"
    }
  },
  "sessionAttributes": {}
}

I thought with verify set to true that it would've thrown an error, correct?

[dblock]

I am not sure what this error is or what to do with it ...

[cpup22]

It's not an error. That's the point. If a request comes in from a non-echo, my assumption is the alexa-verifier code should mark it as an error. and there is no error.

[dblock]

Possibly, I don't know much about this. I would read the code and docs wrt what it's supposed to do, maybe open an issue in alexa-verifier?

[cpup22]

So, just to make sure I'm following you, are you saying that the flag "verify" in the alexa-app-server documentation:

// This will add verification for alexa requests as require by the alexa certification 
    // process. Provied by alexa-verifier 
    verify: false,

hasn't been tested? And I should use the alexa-verifier module directly?

[mreinstein]

I've never used alexa-app-server, so I can't claim to be any sort of expert on that. One thing I did notice in looking at the code:

https://github.com/alexa-js/alexa-app-server/blob/master/index.js#L85

this is not forcing the requests to pass the header check. It should instead probably be:

self.express.use(endpoint, alexaVerifierMiddleware({ strictHeaderCheck: true ));

^ this is assuming only Alexa requests will flow through this express instance.

[mreinstein]

@tejashah88 I need your input on something. The PR I just sent enforces strict header checking and all of the verification logic that amazon requires when submitting a skill to run on production. I've noticed these tests:

https://github.com/alexa-js/alexa-app-server/blob/master/test/test-examples-server-verification.js

2 of them expect a 200 code back. I think these should actually be 401 errors.

I'd appreciate your thoughts since it seems you actually wrote the tests.

[tejashah88]

@mreinstein You're right! They should be expecting 401 errors.

I guess the only thing that seems to nag me is that we don't have a way to actually test if a 200 code is being sent back when using an actual Alexa device, since we are basically assuming that it should work anyways. Unless Amazon gave a way to test this with a virtual Amazon device or something, I guess one would have to have some sort of test skill that would verify that the verification is working as expected.

[dblock]

Closed via #51, thanks @mreinstein.