Middleware

Verifies the Ed25519 signature on every incoming request before it reaches the interactions endpoint. Discord requires this — requests that fail verification are rejected with a 401 response.

The raw request body is read once here and stored on request.state.raw_body for the route handler to consume directly, avoiding the need to re-read the stream downstream.

Note

This middleware is added automatically when you instantiate Bot. You do not need to add it manually.

Reference

fastapi_interactions.middleware.VerifySignatureMiddleware

Bases: BaseHTTPMiddleware

Source code in fastapi_interactions/middleware.py

class VerifySignatureMiddleware(BaseHTTPMiddleware):
    def __init__(self, app, public_key: str, interaction_path: str = "/interactions"):
        super().__init__(app)
        self.public_key = public_key
        self.interaction_path = interaction_path

    async def dispatch(self, request: Request, call_next):
        if request.url.path != self.interaction_path:
            return await call_next(request)

        signature = request.headers["x-signature-ed25519"]
        timestamp = request.headers["x-signature-timestamp"]
        if not signature or not timestamp:
            return JSONResponse({"detail": "Missing headers"}, status_code=401)

        body = await request.body()
        verified_signature = verify_signature(
            public_key=self.public_key,
            signature=signature,
            timestamp=timestamp,
            body=body,
        )
        if not verified_signature:
            return JSONResponse({"detail": "Invalid signature"}, status_code=401)
        else:
            request.state.raw_body = body
            return await call_next(request)