api-auth 2.0.1 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 92c46c40ca59ec931c02893f62155ea3efdfba48
-  data.tar.gz: ac4c5514140b61f5df1b81408898413aef553cf7
+  metadata.gz: 9ee2a233ac1efcbf1af8b4028fde060ab2de42d5
+  data.tar.gz: 32dc7e2f7fb53759ff4d043e03f53914e4944345
 SHA512:
-  metadata.gz: 38370d16d830ae325f862f972b20d267da8135750e923520df5902662cae46b4244a79d1520ec15b9ca4722f76018f88bfbb874bc4b64fd44f70b36f8402d018
-  data.tar.gz: c3a16015aa11cd3da2b296d5729b3c7f0fccdea1e5a8005a98a4b7465e95944a951afdb9a474f182e1ff3df996d5d36e369f37f2cc60ed9e9eaf6c9e82c04985
+  metadata.gz: 5264828dfb7ec5743f4f74bb2b13ac6e8e002f1addfb448bb2e6ded240fe7ef13e0d1d2bc4646c3f568a33d25a32ff32ea4b070ce59c30d6431a8a451350cb2c
+  data.tar.gz: ffed44efe3245f7c74e9a6b76057ec1de088c16805d7f96fd10061d9babb940680e3b4927bc9aa480cd9aa8d03955c60c8fce1c6f596528f2bc4aaa9d2289c13

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+# 2.1.0 (2016-12-22)
+- Fixed a NoMethodError that might occur when using the NetHttp Driver (#130 grahamkenville)
+- More securely compare signatures in a way that prevents timing attacks (#56 leishman, #133 will0)
+- Remove support for MD2 and MD4 hashing algorithms since they are insecure (#134 will0)
+- Disallow requests that are too far in the future to limit the time available for a brute force signature guess (#119 fwininger)
+
 # 2.0.1 (2016-07-25)
 - Support of `api_auth_options` in ActiveResource integration (#102 fwininger)
 - Replace use of `#blank?` with `#nil?` to not depend on ActiveSupport (#114 packrat386)

data/README.md

@@ -72,6 +72,7 @@ Here is the current list of supported request objects:
 * Curb (Curl::Easy)
 * RestClient
 * Faraday
+* Httpi
 
 ### HTTP Client Objects
 

data/VERSION

@@ -1 +1 @@
-2.0.1
+2.1.0

data/api_auth.gemspec

@@ -20,7 +20,8 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'rest-client', '~> 1.6.0'
   s.add_development_dependency 'curb', '~> 0.8.1'
   s.add_development_dependency 'httpi'
-  s.add_development_dependency 'faraday'
+  faraday_version = RUBY_VERSION == '1.8.7' ? '< 0.10' : '>= 0.10'
+  s.add_development_dependency 'faraday', faraday_version
   s.add_development_dependency 'multipart-post', '~> 2.0'
 
   s.files         = `git ls-files`.split("\n")

data/lib/api_auth/base.rb

@@ -41,7 +41,7 @@ module ApiAuth
         false
       elsif !signatures_match?(headers, secret_key, options)
         false
-      elsif request_too_old?(headers)
+      elsif !request_within_time_window?(headers)
         false
       else
         true
@@ -69,14 +69,15 @@ module ApiAuth
 
     private
 
-    AUTH_HEADER_PATTERN = /APIAuth(?:-HMAC-(MD[245]|SHA(?:1|224|256|384|512)?))? ([^:]+):(.+)$/
+    AUTH_HEADER_PATTERN = /APIAuth(?:-HMAC-(MD5|SHA(?:1|224|256|384|512)?))? ([^:]+):(.+)$/
 
-    def request_too_old?(headers)
+    def request_within_time_window?(headers)
       # 900 seconds is 15 minutes
 
-      Time.httpdate(headers.timestamp).utc < (Time.now.utc - 900)
+      Time.httpdate(headers.timestamp).utc > (Time.now.utc - 900) &&
+        Time.httpdate(headers.timestamp).utc < (Time.now.utc + 900)
     rescue ArgumentError
-      true
+      false
     end
 
     def signatures_match?(headers, secret_key, options)
@@ -91,7 +92,16 @@ module ApiAuth
       header_sig = match_data[3]
       calculated_sig = hmac_signature(headers, secret_key, options)
 
-      header_sig == calculated_sig
+      secure_equals?(header_sig, calculated_sig, secret_key)
+    end
+
+    def secure_equals?(m1, m2, key)
+      sha1_hmac(key, m1) == sha1_hmac(key, m2)
+    end
+
+    def sha1_hmac(key, message)
+      digest = OpenSSL::Digest.new('sha1')
+      OpenSSL::HMAC.digest(digest, key, message)
     end
 
     def hmac_signature(headers, secret_key, options)

data/lib/api_auth/request_drivers/net_http.rb

@@ -1,3 +1,4 @@
+require 'time'
 module ApiAuth
   module RequestDrivers # :nodoc:
     class NetHttpRequest # :nodoc:

data/spec/api_auth_spec.rb

@@ -75,37 +75,44 @@ describe 'ApiAuth' do
 
   describe '.authentic?' do
     let(:request) do
-      new_request = Net::HTTP::Put.new('/resource.xml?foo=bar&bar=foo',
-                                       'content-type' => 'text/plain',
-                                       'content-md5' => '1B2M2Y8AsgTpgAmY7PhCfg==',
-                                       'date' => Time.now.utc.httpdate)
+      Net::HTTP::Put.new('/resource.xml?foo=bar&bar=foo',
+                         'content-type' => 'text/plain',
+                         'content-md5' => '1B2M2Y8AsgTpgAmY7PhCfg==',
+                         'date' => Time.now.utc.httpdate)
+    end
 
-      signature = hmac('123', new_request)
-      new_request['Authorization'] = "APIAuth 1044:#{signature}"
-      new_request
+    let(:signed_request) do
+      signature = hmac('123', request)
+      request['Authorization'] = "APIAuth 1044:#{signature}"
+      request
     end
 
     it 'validates that the signature in the request header matches the way we sign it' do
-      expect(ApiAuth.authentic?(request, '123')).to eq true
+      expect(ApiAuth.authentic?(signed_request, '123')).to eq true
     end
 
     it 'fails to validate a non matching signature' do
-      expect(ApiAuth.authentic?(request, '456')).to eq false
+      expect(ApiAuth.authentic?(signed_request, '456')).to eq false
     end
 
     it 'fails to validate non matching md5' do
       request['content-md5'] = '12345'
-      expect(ApiAuth.authentic?(request, '123')).to eq false
+      expect(ApiAuth.authentic?(signed_request, '123')).to eq false
     end
 
     it 'fails to validate expired requests' do
       request['date'] = 16.minutes.ago.utc.httpdate
-      expect(ApiAuth.authentic?(request, '123')).to eq false
+      expect(ApiAuth.authentic?(signed_request, '123')).to eq false
+    end
+
+    it 'fails to validate far future requests' do
+      request['date'] = 16.minutes.from_now.utc.httpdate
+      expect(ApiAuth.authentic?(signed_request, '123')).to eq false
     end
 
     it 'fails to validate if the date is invalid' do
       request['date'] = '٢٠١٤-٠٩-٠٨ ١٦:٣١:١٤ +٠٣٠٠'
-      expect(ApiAuth.authentic?(request, '123')).to eq false
+      expect(ApiAuth.authentic?(signed_request, '123')).to eq false
     end
 
     it 'fails to validate if the request method differs' do

data/spec/railtie_spec.rb

@@ -73,7 +73,7 @@ describe 'Rails integration' do
       expect(response.code).to eq('200')
     end
 
-    it 'should forbid a request with properly signed headers but timestamp > 15 minutes' do
+    it 'should forbid a request with properly signed headers but timestamp > 15 minutes ago' do
       request = if ActionController::TestRequest.respond_to?(:create)
                   ActionController::TestRequest.create
                 else
@@ -85,6 +85,18 @@ describe 'Rails integration' do
       expect(response.code).to eq('401')
     end
 
+    it 'should forbid a request with properly signed headers but timestamp > 15 minutes in the future' do
+      request = if ActionController::TestRequest.respond_to?(:create)
+                  ActionController::TestRequest.create
+                else
+                  ActionController::TestRequest.new
+                end
+      request.env['DATE'] = 'Mon, 23 Jan 2100 03:29:56 GMT'
+      ApiAuth.sign!(request, '1044', API_KEY_STORE['1044'])
+      response = generated_response(request, :index)
+      expect(response.code).to eq('401')
+    end
+
     it "should insert a DATE header in the request when one hasn't been specified" do
       request = if ActionController::TestRequest.respond_to?(:create)
                   ActionController::TestRequest.create

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: api-auth
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.1.0
 platform: ruby
 authors:
 - Mauricio Gomes
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-26 00:00:00.000000000 Z
+date: 2016-12-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: appraisal
@@ -168,14 +168,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.10'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.10'
 - !ruby/object:Gem::Dependency
   name: multipart-post
   requirement: !ruby/object:Gem::Requirement
@@ -265,7 +265,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: Simple HMAC authentication for your APIs