Class: Warden::Strategies::HMAC::Base

Inherits:
Base
  • Object
show all
Defined in:
lib/hmac/strategies/base.rb

Overview

Base class for hmac authentication in warden. Provides shared methods such as config access and various helpers.

Author:

Direct Known Subclasses

Header, Query

Instance Method Summary collapse

Instance Method Details

#authenticate! ⇒ Object

Performs authentication. Calls success! if authentication was performed successfully and halt! if the authentication information is invalid.

Delegates parts of the work to signature_valid? which must be implemented in child-strategies.

See Also:



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
# File 'lib/hmac/strategies/base.rb', line 21

def authenticate!
  if "" == secret.to_s
    debug("authentication attempt with an empty secret")
    return fail!("Cannot authenticate with an empty secret")
  end
  
  if check_ttl? && !timestamp_valid?
    debug("authentication attempt with an invalid timestamp. Given was #{timestamp}, expected was #{Time.now.gmtime}")
    return fail!("Invalid timestamp")  
  end
    
  if signature_valid?
    success!(retrieve_user)
  else
    debug("authentication attempt with an invalid signature.")
    fail!("Invalid token passed")
  end
end

#debug(msg) ⇒ Object

Log a debug message if a logger is available.

Parameters:

  • msg (String) —

    The message to log



78
79
80
81
82
 
# File 'lib/hmac/strategies/base.rb', line 78

def debug(msg)
  if logger
    logger.debug(msg)
  end
end

#headers ⇒ Hash

Retrieve the request headers. Header names are normalized by this method by stripping the ‘HTTP_`-prefix and replacing underscores with dashes. `HTTP_X_Foo` is normalized to `X-Foo`.

Returns:

  • (Hash) —

    The request headers



59
60
61
62
63
64
65
 
# File 'lib/hmac/strategies/base.rb', line 59

def headers
  pairs = env.select {|k,v| k.start_with? 'HTTP_'}
      .collect {|pair| [pair[0].sub(/^HTTP_/, '').gsub(/_/, '-'), pair[1]]}
      .sort
   headers = Hash[*pairs.flatten]
   headers   
end

#logger ⇒ Logger

Retrieve a logger. Current implementation can only handle Padrino loggers

Returns:

  • (Logger) —

    the logger, nil if none is available



88
89
90
91
92
 
# File 'lib/hmac/strategies/base.rb', line 88

def logger
  if defined? Padrino
    Padrino.logger
  end
end

#params ⇒ Hash

Retrieve the request query parameters

Returns:

  • (Hash) —

    The query parameters



50
51
52
 
# File 'lib/hmac/strategies/base.rb', line 50

def params
  request.GET
end

#request_method ⇒ String

Retrieve the current request method

Returns:

  • (String) —

    The request method in capital letters



43
44
45
 
# File 'lib/hmac/strategies/base.rb', line 43

def request_method
  env['REQUEST_METHOD'].upcase
end

#retrieve_user ⇒ Mixed

Retrieve a user from the database. Calls the proc given in :retrieve_user, else returns true

Returns:

  • (Mixed) —

    The result of the configured proc, true is no proc was given



70
71
72
73
 
# File 'lib/hmac/strategies/base.rb', line 70

def retrieve_user
  @user ||= config[:retrieve_user].respond_to?(:call) ? config[:retrieve_user].call(self) : true
  @user
end