9
10
11
12
13
14
15
16
17
18
19
|
# File 'lib/fb_graph/auth/signed_request.rb', line 9
def self.verify(client, signed_request)
signature, payload = signed_request.split('.')
raise VerificationFailed.new('No Signature') if signature.blank?
raise VerificationFailed.new('No Payload') if payload.blank?
signature = base64_url_decode signature
data = decode_json base64_url_decode(payload)
raise VerificationFailed.new('Unexpected Signature Algorithm') unless data[:algorithm] == 'HMAC-SHA256'
_signature_ = sign(client.secret, payload)
raise VerificationFailed.new('Signature Invalid') unless signature == _signature_
data
end
|