Integridad del archivo de la aplicación Kameleoon

const axios = require("axios");
const crypto = require("crypto");

const API_SSX_URL = "https://api.kameleoon.com";
const SITE_CODE = "SITE_CODE";
const HASH_TYPE = "SHA256";
const CLIENT_ID = "CLIENT_ID";
const CLIENT_SECRET = "CLIENT_SECRET";

async function obtainAuthToken() {
	const response = await axios({
		url: `${API_SSX_URL}/oauth/token`,
		method: "POST",
		headers: {
			"Content-type": "application/x-www-form-urlencoded"
		},
		data: `grant_type=client_credentials&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}`
	});
	return response.data.access_token;
}

async function obtainHash() {
	const token = await obtainAuthToken();
	const hashCodeResponse = await axios({
		url: `${API_SSX_URL}/sites/${SITE_CODE}/hash`,
		method: "PATCH",
		headers: {
			Authorization: "Bearer " + token,
			"Content-type": "application/json"
		},
		data: `{"hashType": "${HASH_TYPE}"}`
	});

	return hashCodeResponse.data.hashCode; //  { hashCode: 'hashCode', hashType: "SHA256" }
}

<Important>
`kameleoon.js` está obsoleto y ha sido sustituido por `engine.js` en todos los snippets de implementación de Kameleoon. `kameleoon.js` dejará de tener soporte a partir del **1 de junio de 2026**. Después de esa fecha, las campañas en sitios web que sigan referenciando `kameleoon.js` dejarán de funcionar. Recomendamos encarecidamente actualizar su snippet de implementación en consecuencia.
</Important>


// función para comparar el código hash




	async function checkHash() {
	const scriptResponse = await axios({
		url: `https://${SITE_CODE}.kameleoon.io/engine.js?t=${new Date().getTime()}`,
		method: "GET"
	});
	const hashCodeFromAPI = await obtainHash();
	const hashCode = crypto.createHash(HASH_TYPE).update(scriptResponse.data).digest("hex");
	return hashCodeFromAPI === hashCode;
}

checkHash();

<?php

$API_SSX_URL = 'https://api.kameleoon.com';
$SITE_CODE = 'SITE_CODE';
$HASH_TYPE = 'SHA256';
$CLIENT_ID = 'CLIENT_ID';
$CLIENT_SECRET = 'CLIENT_SECRET';

$tokenRequest = curl_init($API_SSX_URL . "/oauth/token");
curl_setopt($tokenRequest, CURLOPT_POST, 1);
curl_setopt($tokenRequest, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($tokenRequest, CURLOPT_POSTFIELDS, "grant_type=client_credentials&client_id=" . $CLIENT_ID . "&client_secret=" . $CLIENT_SECRET);
$tokenOutput = curl_exec($tokenRequest);
curl_close($tokenRequest);
$token = json_decode($tokenOutput)->access_token;

$hashRequest = curl_init($API_SSX_URL . "/sites/" . $SITE_CODE . "/hash");
curl_setopt($hashRequest, CURLOPT_CUSTOMREQUEST, 'PATCH');
curl_setopt($hashRequest, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($hashRequest, CURLOPT_POSTFIELDS, json_encode(array(
  'hashType' => $HASH_TYPE
)));
curl_setopt($hashRequest, CURLOPT_HTTPHEADER, array(
  'Content-Type: application/json',
  'Authorization: Bearer ' . $token
));
$hashOutput = curl_exec($hashRequest);
curl_close($hashRequest);
$hash = json_decode($hashRequest)->hashCode;

// Algún método para comparar el código hash
checkHash($hash);