在SMART（FHIR）应用中，如何验证EHR请求的合法性？

Great question! You’ve got the EHR-to-app verification flow sorted, but the reverse is just as vital for keeping your app and patient data secure. Luckily, SMART on FHIR defines clear, standard mechanisms for apps to validate that incoming requests—whether they’re authorization responses, FHIR API callbacks, or webhook notifications—are indeed coming from your registered EHR. Let’s break down the key methods:

Core Validation Mechanisms #

1. OAuth 2.0/OpenID Connect Token Validation #

For any interaction involving tokens (like receiving an authorization code response, or validating tokens attached to EHR-initiated API calls), you’ll rely on OpenID Connect standards:

• ID Tokens: When using OpenID Connect flows, the EHR issues an ID token alongside access tokens. Your app must:
  • Verify the token’s digital signature using the EHR’s public keys, which you can fetch from its well-known configuration endpoint (e.g., {ehr-base-url}/.well-known/openid-configuration).
  • Confirm the iss (issuer) claim exactly matches the EHR’s registered issuer URL.
  • Check that the aud (audience) claim matches your app’s client ID—this ensures the token was meant for your app specifically.
  • Validate the exp (expiration) timestamp to make sure the token hasn’t expired.
• Access Tokens: For FHIR API requests initiated by the EHR (or when you need to confirm a token’s validity), use the EHR’s token introspection endpoint (listed in the well-known config). This endpoint will return metadata confirming the token is valid, issued by the correct EHR, and intended for your app.

2. Webhook Request Signature Validation #

If your app uses SMART webhooks to receive event notifications from the EHR (like when a patient’s record is updated), the EHR will sign each request with a pre-shared secret established during app registration:

• The EHR includes a X-SMART-Signature header, which contains a HMAC-SHA256 signature of the request body (and sometimes critical headers).
• Your app computes the HMAC of the same request content using the pre-shared secret, then compares it to the signature in the header.
• Always validate any timestamp included in the signature to prevent replay attacks—reject requests that are too old.

3. FHIR Server Metadata Validation #

Before engaging with the EHR’s FHIR API, fetch its capability statement at {ehr-base-url}/metadata and verify:

• The server’s fhirVersion matches the version your app is built to support.
• The security section lists the exact OAuth 2.0 endpoints (authorization, token, introspection) that you registered with the EHR.
• The server’s base URL matches the one you have on file for your registered EHR instance.

4. Mutual TLS (mTLS) for Enhanced Security #

Some enterprise-grade EHRs support mutual TLS, where both the app and EHR present digital certificates to authenticate each other:

• Your app can verify the EHR’s TLS certificate against a trusted certificate authority (CA).
• Ensure the certificate’s subject or Subject Alternative Name (SAN) matches the EHR’s registered domain or base URL.

Critical Best Practices #

• Avoid hardcoding endpoints: Always pull the latest configuration from the EHR’s well-known OpenID endpoint—this prevents issues if the EHR updates its endpoints.
• Secure your secrets: Store pre-shared webhook secrets, client secrets, and private keys in a secure vault (never in code or plaintext configuration files).
• Fail fast on invalid requests: If any validation step fails, immediately discard the request and log the incident for auditing purposes.

内容的提问来源于stack exchange，提问作者John