Class: Warden::Strategies::HMAC::Header

Inherits:
Base
  • Object
show all
Defined in:
lib/hmac/strategies/header.rb

Overview

Implements header-based hmac authentication for warden. The strategy is registered as ‘:hmac_header` in the warden strategy list.

Author:

Instance Method Summary collapse

Methods inherited from Base

#authenticate!, #debug, #headers, #logger, #params, #request_method, #retrieve_user

Instance Method Details

#given_signature ⇒ String

retrieve the signature from the request

Returns:

  • (String) —

    The signature from the request



55
56
57
 
# File 'lib/hmac/strategies/header.rb', line 55

def given_signature
  parsed_auth_header['signature']
end

#nonce ⇒ String

retrieve the nonce from the request

Returns:

  • (String) —

    The nonce or an empty string if no nonce was given in the request



75
76
77
 
# File 'lib/hmac/strategies/header.rb', line 75

def nonce
  headers[nonce_header_name]
end

#parsed_auth_header ⇒ Hash

parses the authentication header from the request using the regexp or proc given in the :auth_header_parse option. The result is memoized

Returns:

  • (Hash) —

    The parsed header



64
65
66
67
68
69
70
 
# File 'lib/hmac/strategies/header.rb', line 64

def parsed_auth_header
  if @parsed_auth_header.nil?
    @parsed_auth_header = auth_header_parse.match(headers[auth_header]) || {}
  end
  
  @parsed_auth_header
end

#request_timestamp ⇒ String

retrieve the request timestamp as string

Returns:

  • (String) —

    The request timestamp or an empty string if no timestamp was given in the request



82
83
84
 
# File 'lib/hmac/strategies/header.rb', line 82

def request_timestamp
  headers[date_header]
end

#signature_valid? ⇒ Bool

Check that the signature given in the request is valid.

Returns:

  • (Bool) —

    true if the request is valid



26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/hmac/strategies/header.rb', line 26

def signature_valid?
    
  #:method => "GET",
  #:date => "Mon, 20 Jun 2011 12:06:11 GMT",
  #:nonce => "TESTNONCE",
  #:path => "/example",
  #:query => {
  #  "foo" => "bar",
  #  "baz" => "foobared"
  #},
  #:headers => {
  #  "Content-Type" => "application/json;charset=utf8",
  #  "Content-MD5" => "d41d8cd98f00b204e9800998ecf8427e"
  #}
    
  hmac.validate_signature(given_signature, {
    :secret => secret,
    :method => request_method,
    :date => request_timestamp,
    :nonce => nonce,
    :path => request.path,
    :query => params,
    :headers => headers.select {|name, value| optional_headers.include? name}
  })
end

#valid? ⇒ Bool

Checks that this strategy applies. Tests that the required authentication information was given.

Returns:

  • (Bool) —

    true if all required authentication information is available in the request

See Also:



17
18
19
20
21
 
# File 'lib/hmac/strategies/header.rb', line 17

def valid?
  valid = required_headers.all? { |h| headers.include?(h) } && headers.include?("AUTHORIZATION") && has_timestamp?
  valid = valid && scheme_valid?
  valid
end