VerifyWithMaxAge is the configurable-window variant of Verify.
(secrets []string, h AuthHeaders, maxAge time.Duration)
| 102 | |
| 103 | // VerifyWithMaxAge is the configurable-window variant of Verify. |
| 104 | func VerifyWithMaxAge(secrets []string, h AuthHeaders, maxAge time.Duration) bool { |
| 105 | sig := h[HeaderSignature] |
| 106 | if sig == "" { |
| 107 | return false |
| 108 | } |
| 109 | |
| 110 | ts, err := time.Parse(time.RFC3339, h[HeaderTimestamp]) |
| 111 | if err != nil { |
| 112 | return false |
| 113 | } |
| 114 | age := time.Since(ts) |
| 115 | if age < -30*time.Second || age > maxAge { |
| 116 | return false |
| 117 | } |
| 118 | |
| 119 | canonical := canonicalString( |
| 120 | h[HeaderVerified], |
| 121 | h[HeaderSender], |
| 122 | h[HeaderEntityType], |
| 123 | h[HeaderDomainCheck], |
| 124 | h[HeaderDelegation], |
| 125 | h[HeaderTimestamp], |
| 126 | h[HeaderMessageID], |
| 127 | h[HeaderBodyHash], |
| 128 | ) |
| 129 | |
| 130 | for _, secret := range secrets { |
| 131 | mac := hmac.New(sha256.New, []byte(secret)) |
| 132 | mac.Write([]byte(canonical)) |
| 133 | expected := hex.EncodeToString(mac.Sum(nil)) |
| 134 | if hmac.Equal([]byte(sig), []byte(expected)) { |
| 135 | return true |
| 136 | } |
| 137 | } |
| 138 | return false |
| 139 | } |
| 140 | |
| 141 | // Signer is a thin wrapper around a single secret. Kept for the legacy |
| 142 | // deployment-wide signing path used in tests and the contract server; |