http_signature 0.0.4 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA256:
-  metadata.gz: 6320c8fac16dd162425c863e231bd09f61813b2e9ee5106e793c2eae062a08fc
-  data.tar.gz: 86297b14149a73e71075280e8d0cd832ef5af322789aa55a8b729f5aec3d6834
+SHA1:
+  metadata.gz: 6e856db84d163534a1f63dda575f6638f3a0a176
+  data.tar.gz: a0f25862111f95abf82f598902f928acfd62d3e5
 SHA512:
-  metadata.gz: f7da7985ac3900b7422143ecff5cda1bcc78eb4ae3f4b750bf74c296dc41f2b5411e45dbd0e5d7aebc548c782d400889f46b2be4497ba36a5cdc370133d335fe
-  data.tar.gz: 393d8df6ded354f2d96cea732bb3017e16c0801f6a94f3e749ec56aee5d7752bac754d6ae76705ae6801ea4fb761a391923eafd50616c663339e69627b4da026
+  metadata.gz: 3a9b3e8636cc8c1689c47016fcfe271b4b2bca8bf618045894750efa695295ead602a33daa75b085647b8cf7a2d2833eba158d2bffb562bb4fdca94c4d81cbe6
+  data.tar.gz: 68027c22824a7d0468e57d287d00f5fd087861c03ca9637e356630d5f7f9cc0e498a6011d7e3600c24af9d17a1ba2cf930bf87c71d5d6a38b86b4f6a11c48aae

data/.ruby-version

@@ -0,0 +1 @@
+2.4.0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    http_signature (0.0.4)
+    http_signature (0.0.5)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -18,7 +18,7 @@ require 'http_signature'
 ```
 
 ### Basic
-The most basic usage without any extra headers. The default algorithm is `hmac-sha256`.
+The most basic usage without any extra headers. The default algorithm is `hmac-sha256`. This create the `Signature` header value. Next step is to add the value to the header and 💥 you're done!
 ```ruby
 HTTPSignature.create(
   url: 'https://example.com/foo',
@@ -110,7 +110,7 @@ HTTPSignature.valid?(
 Example of using it on an outgoing request.
 ```ruby
 require 'http_signature/faraday'
-# Two variables needed to be set
+
 HTTPSignature::Faraday.key = 'MySecureKey' # This should be long and random
 HTTPSignature::Faraday.key_id = 'key-1' # For the recipient to know which key to decrypt with
 
@@ -123,6 +123,11 @@ end
 
 # Now this request will contain the `Signature` header
 response = conn.get('/')
+
+# Request looking like:
+# GET / HTTP/1.1
+# User-Agent: Faraday v0.15.0
+# Signature: keyId="key-1",algorithm="hmac-sha256",headers="(request-target) date",signature="EzFa4vb0z+VFF8VYt9qQlzF9MTf5Izptc02OJ7aajnU="
 ```
 
 ### Rack middleware for incoming requests
@@ -134,6 +139,8 @@ Sinatra for example
 require 'http_signature/rack'
 
 HTTPSignature.config(keys: [{ id: 'key-1', value: 'MySecureKey' }])
+# You can exclude paths where you don't want to validate the signature:
+HTTPSignature::Rack.exclude_paths = ['/']
 
 use HTTPSignature::Rack
 run MyApp
@@ -142,14 +149,17 @@ run MyApp
 #### Rails
 Checkout [this documentation](http://guides.rubyonrails.org/rails_on_rack.html). But in short, add this inside the config block:
 ```ruby
+require 'http_signature/rack' # This doesn't have to be inside the block
 config.middleware.use HTTPSignature::Rack
 ```
 
-and don't forget to set the key env somewhere, an initializer should be suitable:
+Don't forget to set the keys somewhere, an initializer should be suitable. Multiple keys
+are supported to be able to easily be rotated.
 ```ruby
 HTTPSignature.config(keys: [{ id: 'key-1', value: 'MySecureKey' }])
 ```
 
+
 ## Development
 Install dependencies and then you can start running the tests!
 ```

data/http_signature.gemspec

@@ -3,7 +3,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = 'http_signature'
-  spec.version       = '0.0.4'
+  spec.version       = '0.0.5'
   spec.authors       = ['Joel Larsson']
   spec.email         = ['bolmaster2@gmail.com']
 

data/lib/http_signature/faraday.rb

@@ -11,9 +11,14 @@ class HTTPSignature::Faraday < Faraday::Middleware
   def call(env)
     raise 'key and key_id needs to be set' if self.class.key.nil? || self.class.key_id.nil?
 
-    if env[:body]
-      env[:request_headers].merge!('Digest' => HTTPSignature.create_digest(env[:body]))
-    end
+    body =
+      if env[:body] && env[:body].respond_to?(:read)
+        string = env[:body].read
+        env[:body].rewind
+        string
+      else
+        env[:body].to_s
+      end
 
     # Choose which headers to sign
     filtered_headers = %w{ Host Date Digest }
@@ -26,7 +31,7 @@ class HTTPSignature::Faraday < Faraday::Middleware
       key: self.class.key,
       key_id: self.class.key_id,
       algorithm: 'hmac-sha256',
-      body: env[:body] ? env[:body] : ''
+      body: body
     )
 
     env[:request_headers].merge!('Signature' => signature)

data/lib/http_signature/rack.rb

@@ -4,28 +4,38 @@ require 'http_signature'
 
 # Rack middleware using http-signature gem to validate signature on every incoming request
 class HTTPSignature::Rack
+  class << self
+    attr_accessor :exclude_paths
+  end
+
   def initialize(app)
     @app = app
+    self.class.exclude_paths ||= []
   end
 
   def call(env)
     request = Rack::Request.new(env)
+
+    return @app.call(env) if path_excluded?(request.path)
+
     return [401, {}, ['No signature header']] unless request.get_header("HTTP_SIGNATURE")
 
-    request_body = request.body.gets
-    request_headers = parse_request_headers(request)
     begin
+      request_body = request.body.read
+      request_headers = parse_request_headers(request)
       parsed_signature = parse_signature(request_headers)
+      key = HTTPSignature.key(parsed_signature['keyId'])
     rescue
       return [401, {}, ['Invalid signature :(']]
     end
+
     headers_to_sign = request_headers.select { |k, v| parsed_signature['headers'].include?(k) }
 
     params = {
       url: request.path,
       method: request.request_method,
       headers: headers_to_sign,
-      key: HTTPSignature.key(parsed_signature['keyId']),
+      key: key,
       key_id: parsed_signature['keyId'],
       algorithm: parsed_signature['algorithm'],
       body: request_body ? request_body : '',
@@ -67,4 +77,8 @@ class HTTPSignature::Rack
       [k, v.tr('"', '')]
     end.to_h
   end
+
+  def path_excluded?(path)
+    self.class.exclude_paths.include?(path)
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: http_signature
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
 platform: ruby
 authors:
 - Joel Larsson
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-04-30 00:00:00.000000000 Z
+date: 2018-05-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -75,6 +75,7 @@ extra_rdoc_files: []
 files:
 - ".circleci/config.yml"
 - ".gitignore"
+- ".ruby-version"
 - Gemfile
 - Gemfile.lock
 - README.md
@@ -103,7 +104,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.3
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: Create and validate HTTP request signature