Class: Warden::Strategies::HMAC::Header

Inherits:
Base
  • Object
show all
Defined in:
lib/hmac/strategies/header.rb

Overview

Implements header-based hmac authentication for warden. The strategy is registered as ‘:hmac_header` in the warden strategy list.

Instance Method Summary collapse

Methods inherited from Base

#authenticate!, #debug, #headers, #logger, #params, #request_method, #retrieve_user

Instance Method Details

#given_signature ⇒ String

retrieve the signature from the request



55
56
57
 
# File 'lib/hmac/strategies/header.rb', line 55

def given_signature
  parsed_auth_header['signature']
end

#nonce ⇒ String

retrieve the nonce from the request



75
76
77
 
# File 'lib/hmac/strategies/header.rb', line 75

def nonce
  headers[nonce_header_name]
end

#parsed_auth_header ⇒ Hash

parses the authentication header from the request using the regexp or proc given in the :auth_header_parse option. The result is memoized



64
65
66
67
68
69
70
 
# File 'lib/hmac/strategies/header.rb', line 64

def parsed_auth_header
  if @parsed_auth_header.nil?
    @parsed_auth_header = auth_header_parse.match(headers[auth_header]) || {}
  end
  
  @parsed_auth_header
end

#request_timestamp ⇒ String

retrieve the request timestamp as string



82
83
84
 
# File 'lib/hmac/strategies/header.rb', line 82

def request_timestamp
  headers[date_header]
end

#signature_valid? ⇒ Bool

Check that the signature given in the request is valid.



26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/hmac/strategies/header.rb', line 26

def signature_valid?
    
  #:method => "GET",
  #:date => "Mon, 20 Jun 2011 12:06:11 GMT",
  #:nonce => "TESTNONCE",
  #:path => "/example",
  #:query => {
  #  "foo" => "bar",
  #  "baz" => "foobared"
  #},
  #:headers => {
  #  "Content-Type" => "application/json;charset=utf8",
  #  "Content-MD5" => "d41d8cd98f00b204e9800998ecf8427e"
  #}
    
  hmac.validate_signature(given_signature, {
    :secret => secret,
    :method => request_method,
    :date => request_timestamp,
    :nonce => nonce,
    :path => request.path,
    :query => params,
    :headers => headers.select {|name, value| optional_headers.include? name}
  })
end

#valid? ⇒ Bool

Checks that this strategy applies. Tests that the required authentication information was given.

See Also:



17
18
19
20
21
 
# File 'lib/hmac/strategies/header.rb', line 17

def valid?
  valid = required_headers.all? { |h| headers.include?(h) } && headers.include?("AUTHORIZATION") && has_timestamp?
  valid = valid && scheme_valid?
  valid
end