CakePHP HTTP authorization header check - rest

Question

I need to implement xsolla payment solution into my CakePHP 2.6 webapp.
By contract my site should communicate via REST with Xsolla.
Every request should contain Authorization Signature header which is sha1 hash of JSON body and the secret token.
Where is the right place to check Signature from xsolla in cakePHP?
Example request from xsolla:
URL: http://example.com/rest
Accept: application/json
Content-Type: application/json
Content-Length: 78
Authorization: Signature 8189119fb35327cdee7787990df41001c4bd9122
{"data":{"notification_type":"user_validation","user":{"id":"user_id"}}}
I need to check Authorization: Signature

Answer 1

The correct way of handling this in CakePHP is to implement a custom authorization handler. See the following links for reference, they explain what you need to do in great detail.
The basic procedure is to read the auth header and compare it against the user in your database. You'll do that in your custom authorization handler.
CakePHP 2.x
Authorization
Creating custom authorization handlers
CakePHP 3.x
Authorization
Creating custom authorization handlers
JWT Token Auth (check the code for reference)
The JWT auth is basically exactly doing what you want. The auth adapters aren't that much different. So you can backport that to CakePHP 2.x