Class: FbGraph::Auth::SignedRequest

Inherits:
Object
  • Object
show all
Defined in:
lib/fb_graph/auth/signed_request.rb

Constant Summary collapse

OAUTH_DIALOG_ENDPOINT = 
'https://www.facebook.com/dialog/oauth'

Class Method Summary collapse

Class Method Details

.base64_url_decode(str) ⇒ Object 



34
35
36
37
38
 
# File 'lib/fb_graph/auth/signed_request.rb', line 34

def self.base64_url_decode(str)
  str += '=' * (4 - str.length.modulo(4))
  str = str.gsub('-', '+').gsub('_', '/')
  Base64.decode64 str
end

.decode_json(json) ⇒ Object 



28
29
30
31
32
 
# File 'lib/fb_graph/auth/signed_request.rb', line 28

def self.decode_json(json)
  MultiJson.load(json).with_indifferent_access
rescue => e
  raise VerificationFailed.new('Invalid JSON')
end

.sign(key, payload) ⇒ Object 



23
24
25
26
 
# File 'lib/fb_graph/auth/signed_request.rb', line 23

def self.sign(key, payload)
  klass = OpenSSL::Digest::SHA256.new
  OpenSSL::HMAC.digest(klass, key, payload)
end

.verify(client, signed_request) ⇒ Object

Raises:



9
10
11
12
13
14
15
16
17
18
19
 
# File 'lib/fb_graph/auth/signed_request.rb', line 9

def self.verify(client, signed_request)
  signature, payload = signed_request.split('.')
  raise VerificationFailed.new('No Signature') if signature.blank?
  raise VerificationFailed.new('No Payload') if payload.blank?
  signature = base64_url_decode signature
  data = decode_json base64_url_decode(payload)
  raise VerificationFailed.new('Unexpected Signature Algorithm') unless data[:algorithm] == 'HMAC-SHA256'
  _signature_ = sign(client.secret, payload)
  raise VerificationFailed.new('Signature Invalid') unless signature == _signature_
  data
end