Internal Dream Consistency service-to-service authentication package for API-to-API communication using HMAC-signed HTTP requests, client handlers, server middleware, service identity validation, and request-bound signatures.
DreamConsistency.Security.ServiceAuth provides internal API-to-API
authentication for Dream Consistency backend services. It signs outgoing HTTP requests
on the client side and validates signed requests on the server side.
The package is designed for internal Dream Consistency service communication, such as Legislator services, Hestino services, AccessControl services, and future internal APIs.
| Property | Current Decision |
|---|---|
| Package ID | DreamConsistency.Security.ServiceAuth |
| Initial Release | 1.0.0 |
| Target Framework | .NET Standard 2.1 |
| NuGet Feed | https://nuget.dreamconsistency.com/v3/index.json |
| Package Hosting | BaGetter on Dream Consistency Hub server. |
| Release Pipeline | DreamConsistency.Security.ServiceAuth - NuGet Release |
| Jenkins Folder | DreamConsistency - Packages |
| Versioning | Semantic Versioning: MAJOR.MINOR.PATCH |
| Visibility | Internal Dream Consistency package. |
| Package | Version | Purpose |
|---|---|---|
DreamConsistency.Crypto |
1.0.0 |
HMAC signing, SHA256 hashing, secure comparison, and root key resolution. |
DreamConsistency.Extensions |
1.0.2 |
Dream Consistency service descriptor and shared infrastructure models. |
DreamConsistency.Extensions because
every Dream Consistency service already exposes its identity through
DreamConsistency_ServiceDescriptor.Instance.ServiceInfo.Service_UUID.
The purpose of this package is to provide a lightweight internal service authentication layer without introducing OAuth, token servers, or external identity infrastructure.
| Area | Responsibility |
|---|---|
| Client Request Signing | Signs outgoing HTTP requests using the current service identity and HMAC signature. |
| Server Request Validation | Validates signed internal requests through ASP.NET Core middleware. |
| Service Identity | Uses DreamConsistency_ServiceDescriptor.Instance.ServiceInfo.Service_UUID as the service identifier. |
| Sender Whitelist | Validates whether the calling service is allowed through the Dream Consistency service whitelist. |
| Timestamp Validation | Rejects requests outside the allowed clock-skew window. |
| Request-bound Signature | V2 signature binds the signature to method, path, query, and body hash. |
The package contains a small framework-neutral signing core, an HttpClient handler for outgoing requests, and ASP.NET Core middleware for validating incoming internal requests.
The package supports gradual migration by sending and validating both legacy V1 signatures and stronger request-bound V2 signatures.
The package supports two signature modes.
| Signature | Status | Signed Data |
|---|---|---|
V1 |
Legacy compatibility | serviceId | timestamp | nonce |
V2 |
Preferred | serviceId | timestamp | nonce | method | pathAndQuery | bodySha256 |
Header names are defined centrally in DcSecurityHeaders. The package adds
service identity, timestamp, nonce, body hash, and signature headers to internal requests.
| Header | Purpose |
|---|---|
| Service ID header | Identifies the Dream Consistency service making the request. |
| Timestamp header | Prevents old requests from being accepted outside the allowed time window. |
| Nonce header | Adds uniqueness to each signed request. |
| Body SHA256 header | Contains the SHA256 hash of the request body for V2 request-bound signatures. |
X-DreamConsistency-Signature |
Legacy V1 HMAC signature for compatibility with older clients and servers. |
X-DreamConsistency-Signature-V2 |
Preferred V2 HMAC signature bound to method, path, query, and body hash. |
Version 1.0.1 is designed to support gradual rollout across existing services.
| Scenario | Expected Behavior |
|---|---|
| New client → old server | Works through legacy V1 signature. |
| Old client → new server | Works through V1 fallback validation. |
| New client → new server | Uses preferred V2 request-bound signature. |