active_hashcash 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8e7f600a4c42efa28175ebb98d4ba2206295bb316b450f79167fae543a52f71
-  data.tar.gz: a62096662ee76b1b31529c71660cae12d8c0c7b01033d2440490aef839d6ed3f
+  metadata.gz: ef5393e959b8a94792f35bc043c87542568398d3c9444a8e238ba6eafdbb3522
+  data.tar.gz: 74a51e94325581bf35113f81ccaccd696079bc43cfedc7f734ae5889ab0bb32f
 SHA512:
-  metadata.gz: 4fa81355c730a651547d30e0e115bbfc3bcc35623482efb85d324e6ecf826acec46dc7f3b47a8dce48264f8da227b487465d98ba964571b3670f244188653590
-  data.tar.gz: 9aeb5f2fa5c053795402d30c286491f43034a173a26913e3ec81210bb6da95dbc11a547cba98fab1bff81fc22eb832e2984744df1bdc580482c8d882ba213926
+  metadata.gz: 5d0da77fac447177abebbf04a585927f42d7a100159bf9ab8df1305f1f88b9a394738c03f5a828177dea71f745a941b9bff7a8625c4cc8c5744fc735ef017cc2
+  data.tar.gz: 6845cb211b39fa5dfe0f0393df05ae7cd6e5b54f5e8f3e27e26a206f9853b026a7a557e0c5dbbf97e2eb1bc5468b4ef418cec31a9e20c98153b8027c13d30947

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog of ActiveHashcash
 
+## 0.5.0 (2026-08-08)
+
+- Fix stamp date mismatch by using server date instead of client
+- Replace SHA-1 with SHA-256 for proof-of-work stamps
+- Mine stamps in a Web Worker using pure JS SHA-256 (keeps the main thread unblocked)
+- Support SHA-1 fallback on the backend for backward compatibility (via the `ext` stamp field)
+
 ## 0.4.0 (2025-05-15)
 
 - Prevent from password managers to submit the form before the stamp has been computed

data/README.md

@@ -179,16 +179,28 @@ You can change the minimum complexity with `ActiveHashcash.bits = 20`.
 Since version 0.3.0, the complexity increases with the number of stamps spent during le last 24H from the same IP address.
 Thus it becomes very efficient to slow down brute force attacks.
 
+## Testing
+
+Browser tests submit the real form, so they have to compute a real stamp. At the default 16 bits this adds noticeable time to every submission and slows down your suite. Drop the complexity in the test environment so it finishes almost instantly:
+
+```ruby
+# spec/rails_helper.rb (RSpec) or test/test_helper.rb (Minitest)
+ActiveHashcash.bits = 2
+```
+
+In controller tests, provide the hashcash this way:
+
+```ruby
+post(url, params: {hashcash: ActiveHashcash::Stamp.mint(host).to_s})
+```
+
 ## Limitations
 
-The JavaScript implementation is 10 to 20 times slower than the official C version.
-I first used the SubtleCrypto API but it is surprisingly slower than a custom SHA1 implementation.
-Maybe I did in an inefficient way 2df3ba5?
-Another idea would be to compile the work algorithm in wasm.
+The JavaScript implementation is slower than the official C version.
+It uses a pure JS SHA-256 implementation running inside a Web Worker, which keeps the main thread responsive while mining.
+A synchronous tight loop avoids the per-call async overhead of `crypto.subtle.digest()`, making it the fastest browser-side approach across Chrome and Safari.
 
-Unfortunately, I'm not a JavaScript expert.
-Maybe you have good JS skills to optimize it?
-Any help would be appreciate to better fights bots and brute for attacks!
+No `crypto.subtle` or secure context (HTTPS) is required, so it works in any environment including plain HTTP during development.
 
 ## Contributing
 

data/app/assets/javascripts/hashcash.js

@@ -1,11 +1,15 @@
 // http://www.hashcash.org/docs/hashcash.html
-// <input type="hiden" name="hashcash" data-hashcash="{resource: 'site.example', bits: 16}"/>
+// <input type="hidden" name="hashcash" data-hashcash="{resource: 'site.example', bits: 16}"/>
 Hashcash = function(input) {
   options = JSON.parse(input.getAttribute("data-hashcash"))
   Hashcash.disableParentForm(input, options)
   input.dispatchEvent(new CustomEvent("hashcash:mint", {bubbles: true}))
 
   Hashcash.mint(options.resource, options, function(stamp) {
+    // Guard against Turbo navigation: if the input is no longer in the DOM,
+    // the user has navigated away and we should silently discard the result.
+    if (!input.isConnected) return
+
     input.value = stamp.toString()
     Hashcash.enableParentForm(input, options)
     input.dispatchEvent(new CustomEvent("hashcash:minted", {bubbles: true, detail: {stamp: stamp}}))
@@ -20,9 +24,39 @@ Hashcash.setup = function() {
     var input = document.querySelector("input#hashcash")
     input && new Hashcash(input)
   } else
-    document.addEventListener("DOMContentLoaded", Hashcash.setup )
+    document.addEventListener("DOMContentLoaded", Hashcash.setup)
 }
 
+// Terminate the active worker and clean up its Blob URL.
+Hashcash.cleanup = function() {
+  if (Hashcash._worker) {
+    Hashcash._worker.terminate()
+    Hashcash._worker = null
+  }
+  if (Hashcash._workerUrl) {
+    URL.revokeObjectURL(Hashcash._workerUrl)
+    Hashcash._workerUrl = null
+  }
+}
+
+// Turbo Drive: terminate the worker when navigating away so it doesn't
+// complete after the page has changed, and restore the form state for
+// Turbo's page cache so the snapshot doesn't have disabled buttons.
+document.addEventListener("turbo:before-visit", Hashcash.cleanup)
+document.addEventListener("turbo:before-cache", function() {
+  Hashcash.cleanup()
+  var input = document.querySelector("input#hashcash")
+  if (input && input.form) {
+    input.value = ""
+    input.form.querySelectorAll("[type=submit]").forEach(function(submit) {
+      if (submit.originalValue) {
+        Hashcash.setSubmitText(submit, submit.originalValue)
+      }
+      submit.disabled = null
+    })
+  }
+})
+
 Hashcash.setSubmitText = function(submit, text) {
   if (!text) {
     return
@@ -57,62 +91,45 @@ Hashcash.prototype.preventFromAutoSubmitFromPasswordManagers = function(event) {
 Hashcash.default = {
   version: 1,
   bits: 20,
-  extension: null,
 }
 
 Hashcash.mint = function(resource, options, callback) {
-  // Format date to YYMMDD
-  var date = new Date
-  var year = date.getFullYear().toString()
-  year = year.slice(year.length - 2, year.length)
-  var month = (date.getMonth() + 1).toString().padStart(2, "0")
-  var day = date.getDate().toString().padStart(2, "0")
-
   var stamp = new Hashcash.Stamp(
     options.version || Hashcash.default.version,
     options.bits || Hashcash.default.bits,
-    options.date || year + month + day,
+    options.date || Hashcash.formatToday(),
     resource,
-    options.extension || Hashcash.default.extension,
-    options.rand || Math.random().toString(36).substr(2, 10),
+    options.rand || Math.random().toString(36).substr(2, 10)
   )
   return stamp.work(callback)
 }
 
-Hashcash.Stamp = function(version, bits, date, resource, extension, rand, counter = 0) {
+// Format date to YYMMDD
+Hashcash.formatToday = function() {
+  var date = new Date
+  var year = date.getFullYear().toString()
+  year = year.slice(year.length - 2, year.length)
+  var month = (date.getMonth() + 1).toString().padStart(2, "0")
+  var day = date.getDate().toString().padStart(2, "0")
+  return year + month + day
+}
+
+Hashcash.Stamp = function(version, bits, date, resource, rand, counter) {
   this.version = version
   this.bits = bits
   this.date = date
   this.resource = resource
-  this.extension = extension
   this.rand = rand
-  this.counter = counter
+  this.counter = counter || 0
 }
 
 Hashcash.Stamp.parse = function(string) {
   var args = string.split(":")
-  return new Hashcash.Stamp(args[0], args[1], args[2], args[3], args[4], args[5], args[6])
+  return new Hashcash.Stamp(args[0], args[1], args[2], args[3], args[5], args[6])
 }
 
 Hashcash.Stamp.prototype.toString = function() {
-  return [this.version, this.bits, this.date, this.resource, this.extension, this.rand, this.counter].join(":")
-}
-
-// Trigger the given callback when the problem is solved.
-// In order to not freeze the page, setTimeout is called every 100ms to let some CPU to other tasks.
-Hashcash.Stamp.prototype.work = function(callback) {
-  this.startClock()
-  var timer = performance.now()
-  while (!this.check())
-    if (this.counter++ && performance.now() - timer > 100)
-      return setTimeout(this.work.bind(this), 0, callback)
-  this.stopClock()
-  callback(this)
-}
-
-Hashcash.Stamp.prototype.check = function() {
-  var array = Hashcash.sha1(this.toString())
-  return array[0] >> (160-this.bits) == 0
+  return [this.version, this.bits, this.date, this.resource, "sha256", this.rand, this.counter].join(":")
 }
 
 Hashcash.Stamp.prototype.startClock = function() {
@@ -126,151 +143,176 @@ Hashcash.Stamp.prototype.stopClock = function() {
   console.debug("Hashcash " + this.toString() + " minted in " + duration + "ms (" + speed + " per seconds)")
 }
 
-/**
- * Secure Hash Algorithm (SHA1)
- * http://www.webtoolkit.info/
- **/
-Hashcash.sha1 = function(msg) {
-  var rotate_left = Hashcash.sha1.rotate_left
-  var Utf8Encode = Hashcash.sha1.Utf8Encode
-
-  var blockstart;
-  var i, j;
-  var W = new Array(80);
-  var H0 = 0x67452301;
-  var H1 = 0xEFCDAB89;
-  var H2 = 0x98BADCFE;
-  var H3 = 0x10325476;
-  var H4 = 0xC3D2E1F0;
-  var A, B, C, D, E;
-  var temp;
-  msg = Utf8Encode(msg);
-  var msg_len = msg.length;
-  var word_array = new Array();
-  for (i = 0; i < msg_len - 3; i += 4) {
-    j = msg.charCodeAt(i) << 24 | msg.charCodeAt(i + 1) << 16 |
-      msg.charCodeAt(i + 2) << 8 | msg.charCodeAt(i + 3);
-    word_array.push(j);
-  }
-  switch (msg_len % 4) {
-    case 0:
-      i = 0x080000000;
-      break;
-    case 1:
-      i = msg.charCodeAt(msg_len - 1) << 24 | 0x0800000;
-      break;
-    case 2:
-      i = msg.charCodeAt(msg_len - 2) << 24 | msg.charCodeAt(msg_len - 1) << 16 | 0x08000;
-      break;
-    case 3:
-      i = msg.charCodeAt(msg_len - 3) << 24 | msg.charCodeAt(msg_len - 2) << 16 | msg.charCodeAt(msg_len - 1) << 8 | 0x80;
-      break;
-  }
-  word_array.push(i);
-  while ((word_array.length % 16) != 14) word_array.push(0);
-  word_array.push(msg_len >>> 29);
-  word_array.push((msg_len << 3) & 0x0ffffffff);
-  for (blockstart = 0; blockstart < word_array.length; blockstart += 16) {
-    for (i = 0; i < 16; i++) W[i] = word_array[blockstart + i];
-    for (i = 16; i <= 79; i++) W[i] = rotate_left(W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16], 1);
-    A = H0;
-    B = H1;
-    C = H2;
-    D = H3;
-    E = H4;
-    for (i = 0; i <= 19; i++) {
-      temp = (rotate_left(A, 5) + ((B & C) | (~B & D)) + E + W[i] + 0x5A827999) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
-    }
-    for (i = 20; i <= 39; i++) {
-      temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0x6ED9EBA1) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
+// Mine a valid stamp using a Web Worker with a pure JS SHA-256 implementation.
+// The worker is inlined as a Blob URL so no extra file needs to be served.
+// Using a Web Worker keeps the main thread completely unblocked while mining.
+// A synchronous SHA-256 in a tight loop is faster than async crypto.subtle
+// because it avoids the per-call Promise/microtask overhead entirely.
+Hashcash.Stamp.prototype.work = function(callback) {
+  this.startClock()
+  var self = this
+
+  var workerCode = function() {
+    // SHA-256 round constants (FIPS 180-4 §4.2.2)
+    var K = new Uint32Array([
+      0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+      0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+      0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+      0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+      0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+      0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+      0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+      0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+    ]);
+
+    // Compute SHA-256 over the first `len` bytes of `bytes`. Returns an array
+    // of 8 big-endian 32-bit integers (the 256-bit digest).
+    function sha256bytes(bytes, len) {
+      // Pad to a multiple of 64 bytes: append 0x80, then zeros, then 64-bit
+      // big-endian bit length (we only use the low 32 bits since stamp strings
+      // are always shorter than 512 MB).
+      var padded = new Uint8Array(((len + 9 + 63) & ~63));
+      for (var i = 0; i < len; i++) padded[i] = bytes[i];
+      padded[len] = 0x80;
+      var bitLen = len * 8;
+      var pLen = padded.length;
+      padded[pLen - 4] = (bitLen >>> 24) & 0xff;
+      padded[pLen - 3] = (bitLen >>> 16) & 0xff;
+      padded[pLen - 2] = (bitLen >>> 8) & 0xff;
+      padded[pLen - 1] = bitLen & 0xff;
+
+      // Initial hash values (FIPS 180-4 §5.3.3)
+      var H0 = 0x6a09e667, H1 = 0xbb67ae85, H2 = 0x3c6ef372, H3 = 0xa54ff53a;
+      var H4 = 0x510e527f, H5 = 0x9b05688c, H6 = 0x1f83d9ab, H7 = 0x5be0cd19;
+      var W = new Int32Array(64);
+
+      // Process each 512-bit (64-byte) block
+      for (var off = 0; off < pLen; off += 64) {
+        for (var t = 0; t < 16; t++) {
+          W[t] = (padded[off+t*4]<<24)|(padded[off+t*4+1]<<16)|(padded[off+t*4+2]<<8)|padded[off+t*4+3];
+        }
+        for (var t = 16; t < 64; t++) {
+          var w15 = W[t-15], w2 = W[t-2];
+          W[t] = (W[t-16] + (((w15>>>7)|(w15<<25))^((w15>>>18)|(w15<<14))^(w15>>>3)) + W[t-7] + (((w2>>>17)|(w2<<15))^((w2>>>19)|(w2<<13))^(w2>>>10))) | 0;
+        }
+        var a=H0,b=H1,c=H2,d=H3,e=H4,f=H5,g=H6,h=H7;
+        for (var t = 0; t < 64; t++) {
+          var t1 = (h + (((e>>>6)|(e<<26))^((e>>>11)|(e<<21))^((e>>>25)|(e<<7))) + ((e&f)^(~e&g)) + K[t] + W[t]) | 0;
+          var t2 = ((((a>>>2)|(a<<30))^((a>>>13)|(a<<19))^((a>>>22)|(a<<10))) + ((a&b)^(a&c)^(b&c))) | 0;
+          h=g; g=f; f=e; e=(d+t1)|0; d=c; c=b; b=a; a=(t1+t2)|0;
+        }
+        H0=(H0+a)|0; H1=(H1+b)|0; H2=(H2+c)|0; H3=(H3+d)|0;
+        H4=(H4+e)|0; H5=(H5+f)|0; H6=(H6+g)|0; H7=(H7+h)|0;
+      }
+      return [H0, H1, H2, H3, H4, H5, H6, H7];
     }
-    for (i = 40; i <= 59; i++) {
-      temp = (rotate_left(A, 5) + ((B & C) | (B & D) | (C & D)) + E + W[i] + 0x8F1BBCDC) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
+
+    // Encode a string as bytes into a pre-allocated buffer at `offset`.
+    // Handles ASCII and basic UTF-8 (BMP only).
+    function strToBytes(str, out, offset) {
+      for (var i = 0; i < str.length; i++) {
+        var c = str.charCodeAt(i);
+        if (c < 128) out[offset++] = c;
+        else if (c < 2048) { out[offset++] = (c>>6)|192; out[offset++] = (c&63)|128; }
+        else { out[offset++] = (c>>12)|224; out[offset++] = ((c>>6)&63)|128; out[offset++] = (c&63)|128; }
+      }
+      return offset;
     }
-    for (i = 60; i <= 79; i++) {
-      temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0xCA62C1D6) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
+
+    // Write the decimal digits of `n` as ASCII bytes into `out` at `offset`.
+    // Avoids string allocation in the hot loop.
+    function numToBytes(n, out, offset) {
+      if (n === 0) { out[offset] = 48; return offset + 1; }
+      var digs = [];
+      while (n > 0) { digs.push(48 + (n % 10)); n = (n / 10) | 0; }
+      for (var i = digs.length - 1; i >= 0; i--) out[offset++] = digs[i];
+      return offset;
     }
-    H0 = (H0 + A) & 0x0ffffffff;
-    H1 = (H1 + B) & 0x0ffffffff;
-    H2 = (H2 + C) & 0x0ffffffff;
-    H3 = (H3 + D) & 0x0ffffffff;
-    H4 = (H4 + E) & 0x0ffffffff;
-  }
-  return [H0, H1, H2, H3, H4]
-}
 
-Hashcash.hexSha1 = function(msg) {
-  var array = Hashcash.sha1(msg)
-  var cvt_hex = Hashcash.sha1.cvt_hex
-  return cvt_hex(array[0]) + cvt_hex(array[1]) + cvt_hex(array[2]) + cvt_hex(array3) + cvt_hex(array[4])
-}
+    self.addEventListener("message", function(e) {
+      var d = e.data;
+      var prefix = d.prefix + ":";
+      var bits = d.bits;
+      var counter = 0;
 
-Hashcash.sha1.rotate_left = function(n, s) {
-  var t4 = (n << s) | (n >>> (32 - s));
-  return t4;
-};
-
-Hashcash.sha1.lsb_hex = function(val) {
-  var str = '';
-  var i;
-  var vh;
-  var vl;
-  for (i = 0; i <= 6; i += 2) {
-    vh = (val >>> (i * 4 + 4)) & 0x0f;
-    vl = (val >>> (i * 4)) & 0x0f;
-    str += vh.toString(16) + vl.toString(16);
-  }
-  return str;
-};
-
-Hashcash.sha1.cvt_hex = function(val) {
-  var str = '';
-  var i;
-  var v;
-  for (i = 7; i >= 0; i--) {
-    v = (val >>> (i * 4)) & 0x0f;
-    str += v.toString(16);
+      // Pre-compute how many leading zero bytes and remaining bits to check
+      var fullBytes = Math.floor(bits / 8);
+      var remBits = bits % 8;
+      var mask = remBits > 0 ? (0xFF << (8 - remBits)) & 0xFF : 0;
+
+      // Pre-encode the stamp prefix (everything before the counter) into a
+      // reusable byte buffer. Only the counter digits change per iteration.
+      var buf = new Uint8Array(prefix.length + 12);
+      var prefixLen = strToBytes(prefix, buf, 0);
+
+      // Yield every 65536 iterations so the worker stays terminable.
+      var YIELD = 65536;
+
+      function mine() {
+        var end = counter + YIELD;
+        while (counter < end) {
+          var len = numToBytes(counter, buf, prefixLen);
+          var H = sha256bytes(buf, len);
+
+          // Check leading zero bits by walking the digest words byte-by-byte.
+          var ok = true, byteIdx = 0;
+          check:
+          for (var w = 0; w < 8 && byteIdx <= fullBytes; w++) {
+            var word = H[w];
+            for (var s = 24; s >= 0; s -= 8) {
+              var bv = (word >>> s) & 0xFF;
+              if (byteIdx < fullBytes) {
+                if (bv !== 0) { ok = false; break check; }
+              } else if (byteIdx === fullBytes && remBits > 0) {
+                if ((bv & mask) !== 0) ok = false;
+                break check;
+              } else { break check; }
+              byteIdx++;
+            }
+          }
+          if (ok) { self.postMessage({ found: true, counter: counter }); return; }
+          counter++;
+        }
+        setTimeout(mine, 0);
+      }
+      mine();
+    });
   }
-  return str;
-};
-
-Hashcash.sha1.Utf8Encode = function(string) {
-  string = string.replace(/\r\n/g, '\n');
-  var utftext = '';
-  for (var n = 0; n < string.length; n++) {
-    var c = string.charCodeAt(n);
-    if (c < 128) {
-      utftext += String.fromCharCode(c);
-    } else if ((c > 127) && (c < 2048)) {
-      utftext += String.fromCharCode((c >> 6) | 192);
-      utftext += String.fromCharCode((c & 63) | 128);
-    } else {
-      utftext += String.fromCharCode((c >> 12) | 224);
-      utftext += String.fromCharCode(((c >> 6) & 63) | 128);
-      utftext += String.fromCharCode((c & 63) | 128);
+
+  // Clean up any previous worker (e.g. Turbo restoring a cached page)
+  Hashcash.cleanup()
+
+  var blob = new Blob(
+    ["(" + workerCode.toString() + ")()"],
+    {type: "application/javascript"}
+  )
+  var workerUrl = URL.createObjectURL(blob)
+  var worker = new Worker(workerUrl)
+
+  // Track the active worker so Hashcash.cleanup() can terminate it
+  Hashcash._worker = worker
+  Hashcash._workerUrl = workerUrl
+
+  worker.onmessage = function(e) {
+    if (e.data.found) {
+      Hashcash._worker = null
+      Hashcash._workerUrl = null
+      self.counter = e.data.counter
+      self.stopClock()
+      worker.terminate()
+      URL.revokeObjectURL(workerUrl)
+      callback(self)
     }
   }
-  return utftext;
-};
+
+  // Build the prefix once and send it to the worker. The worker appends the
+  // counter on each iteration, avoiding repeated string building.
+  var prefix = [this.version, this.bits, this.date, this.resource, "sha256", this.rand].join(":")
+
+  worker.postMessage({
+    prefix: prefix,
+    bits: parseInt(this.bits, 10)
+  })
+}
 
 Hashcash.setup()

data/app/models/active_hashcash/stamp.rb

@@ -36,7 +36,7 @@ module ActiveHashcash
       false
     end
 
-    # Pare and instanciate a stamp from a sting which respects the hashcash format:
+    # Parse and instantiate a stamp from a string which respects the hashcash format:
     #
     #   ver:bits:date:resource:[ext]:rand:counter
     def self.parse(string)
@@ -51,6 +51,7 @@ module ActiveHashcash
         bits: ActiveHashcash.bits,
         date: Date.today.strftime(ActiveHashcash.date_format),
         resource: resource,
+        ext: "sha256",
         rand: SecureRandom.alphanumeric(16),
         counter: 0,
       }.merge(attributes)).work
@@ -62,7 +63,11 @@ module ActiveHashcash
     end
 
     def authentic?
-      Digest::SHA1.hexdigest(to_s).hex >> (160-bits) == 0
+      if ext == "sha256"
+        Digest::SHA256.hexdigest(to_s).hex >> (256 - bits) == 0
+      else
+        Digest::SHA1.hexdigest(to_s).hex >> (160 - bits) == 0
+      end
     end
 
     def verify(resource, bits, date)

data/lib/active_hashcash/version.rb

@@ -1,3 +1,3 @@
 module ActiveHashcash
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/active_hashcash.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_hashcash/version"
 require "active_hashcash/engine"
 
@@ -118,7 +120,12 @@ module ActiveHashcash
   #   <% end %>
   #
   def hashcash_hidden_field_tag(name = :hashcash)
-    options = {resource: hashcash_resource, bits: hashcash_bits, waiting_message: hashcash_waiting_message}
+    options = {
+      resource: hashcash_resource,
+      bits: hashcash_bits,
+      waiting_message: hashcash_waiting_message,
+      date: Date.today.strftime("%y%m%d")
+    }
     view_context.hidden_field_tag(name, "", "data-hashcash" => options.to_json)
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_hashcash
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Alexis Bernard
@@ -96,7 +96,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Protect Rails applications against bots and brute force attacks without annoying
   humans.