http_signature 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e13e2dd019cbe8bc7359f1b49cfcd16bd3bb0e11818c7a4709a5892e7a9b362
-  data.tar.gz: 5879cc1525680c68286539b73d7091cdac20218727128af6e42cf2cff36e4c77
+  metadata.gz: 5c57222b061b994515d691691c87192a612eec84694085b03db51e3ea1fa2c75
+  data.tar.gz: ecc70179bb4d76a955b4711b6494e4e0a862ccf811b47d7d4aa3d46253f63066
 SHA512:
-  metadata.gz: 69726bec8a75e3214a9d0c5b3f94f8d65e76c4c64746cc7ade2b11012f8d299d69ac33960f28feb486572702df2460f593cbcc04213f10bf42bd0706404763b8
-  data.tar.gz: e0c993df95150e6698faa87327a806262d7fd7f2141e70cae917dfa89f40ba018acbe721a4b7744b8a5af4ae3e3063fbe4427afbb35a562972de396a05d30acd
+  metadata.gz: 0da5638c340b56fb03fda5aed0e827ef2881e1515da8217c87aa45312d5d81880be3e37179100c9ace8f6788d38b99c916ea6de5a60881d057125d61754d8745
+  data.tar.gz: 600dfb9d3d1a6b4e89c73b9717b5a023b2ccb72c6a38f63dec3ba503e85c417d1af2e7cf8a126192802b63edd547ff4a8a96888d3d933131cea7e28cadf3a7fe

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    http_signature (1.4.0)
+    http_signature (1.5.0)
       base64
       starry (~> 0.2)
 

data/README.md

@@ -57,6 +57,7 @@ HTTPSignature.create(
   created: Time.now.to_i, # Default: Time.now.to_i
   expires: Time.now.to_i + 600, # Default: nil
   nonce: "1", # Default: nil
+  tag: "web-bot-auth", # Default: nil
   label: "sig1", # Default: "sig1"
   query_string_params: {pet2: "cat"}, # Default: {}, you can pass query string params both here and in the `url` param
   algorithm: "hmac-sha512", # Default: "hmac-sha256"
@@ -175,7 +176,7 @@ HTTPSignature.valid?(
   body: request_body, # Default: ""
   key: "secret", # Default: nil, uses key_resolver or configured keys if nil
   key_resolver: ->(key_id) { find_key(key_id) }, # Default: nil, called with the key_id from Signature-Input
-  label: "sig1", # Default: "sig1"
+  label: "sig1", # Default: nil (uses first)
   query_string_params: {}, # Default: {}
   max_age: 300, # Default: nil, reject signatures older than N seconds
   algorithm: "hmac-sha256", # Default: nil, uses alg from Signature-Input or hmac-sha256
@@ -318,7 +319,7 @@ conn = Faraday.new("http://example.com") do |f|
 end
 ```
 
-The middleware also accepts the params: `created:`, `expires:`, `nonce:`, `label:`, `algorithm:`, and `include_alg:`.
+The middleware also accepts the params: `created:`, `expires:`, `nonce:`, `tag:`, `label:`, `algorithm:`, and `include_alg:`.
 
 ### HTTParty
 
@@ -422,6 +423,16 @@ class Api::BaseController < ApplicationController
 end
 ```
 
+To enforce a specific signature label or age limit, use a block:
+
+```ruby
+class Api::BaseController < ApplicationController
+  include HTTPSignature::Rails::Controller
+
+  before_action -> { verify_http_signature!(label: "sig2", max_age: 300) }
+end
+```
+
 Set the keys in an initializer
 ```ruby
 # config/initializers/http_signature.rb

data/lib/http_signature/faraday.rb

@@ -61,7 +61,7 @@ class HTTPSignature::Faraday < Faraday::Middleware
   end
 
   def create_options(options)
-    options.slice(:created, :expires, :nonce, :label, :include_alg, :algorithm)
+    options.slice(:created, :expires, :nonce, :tag, :label, :include_alg, :algorithm)
       .reject { |_key, value| value.nil? }
   end
 end

data/lib/http_signature/rails.rb

@@ -11,7 +11,7 @@ module HTTPSignature
       private
 
       # Use as a Rails before_action to enforce HTTP Message Signatures on an action.
-      def verify_http_signature!
+      def verify_http_signature!(label: nil, max_age: nil)
         request_headers = normalized_request_headers
         signature_input_header = request_headers["signature-input"]
         signature_header = request_headers["signature"]
@@ -25,7 +25,9 @@ module HTTPSignature
           method: request.request_method,
           headers: request_headers,
           body: request_body || "",
-          key_resolver: ->(key_id) { HTTPSignature.key(key_id) }
+          key_resolver: ->(key_id) { HTTPSignature.key(key_id) },
+          label:,
+          max_age:
         )
 
         nil

data/lib/http_signature/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module HTTPSignature
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

data/lib/http_signature.rb

@@ -63,6 +63,7 @@ module HTTPSignature
   # @param created [Integer] Unix timestamp for signature creation (default: Time.now.to_i)
   # @param expires [Integer, nil] Unix timestamp when signature expires (default: nil)
   # @param nonce [String, nil] Random value for signature uniqueness (default: nil)
+  # @param tag [String, nil] Application-specific tag parameter included in signature metadata (default: nil)
   # @param label [String] Signature label in headers (default: "sig1")
   # @param query_string_params [Hash] Additional query params to merge into URL (default: {})
   # @param include_alg [Boolean] Whether to include alg in signature metadata (default: true)
@@ -84,6 +85,7 @@ module HTTPSignature
     created: Time.now.to_i,
     expires: nil,
     nonce: nil,
+    tag: nil,
     label: DEFAULT_LABEL,
     query_string_params: {},
     include_alg: true,
@@ -136,6 +138,7 @@ module HTTPSignature
       key_id:,
       alg: include_alg ? algorithm : nil,
       nonce:,
+      tag:,
       canonical_components:
     )
 
@@ -249,6 +252,7 @@ module HTTPSignature
       key_id:,
       alg: parsed_input[:params][:alg],
       nonce: parsed_input[:params][:nonce],
+      tag: parsed_input[:params][:tag],
       canonical_components:
     )
 
@@ -349,7 +353,11 @@ module HTTPSignature
   def self.verify_content_digest!(header_value, body)
     verified = false
 
-    header_value.scan(/([a-z0-9-]+)=:([A-Za-z0-9+\/=]+):/).each do |alg, encoded_digest|
+    split_header(header_value).each do |entry|
+      alg, digest_value = entry.split("=", 2)
+      next unless alg && digest_value&.start_with?(":") && digest_value.end_with?(":")
+
+      encoded_digest = digest_value[1...-1]
       digest = case alg
       when "sha-256" then Digest::SHA256.digest(body)
       when "sha-512" then Digest::SHA512.digest(body)
@@ -501,6 +509,7 @@ module HTTPSignature
     key_id:,
     alg:,
     nonce:,
+    tag:,
     canonical_components:
   )
     component_tokens = components.map { |c| serialize_component_id(c) }.join(" ")
@@ -509,6 +518,7 @@ module HTTPSignature
     params << %(keyid="#{escape_structured_string(key_id)}")
     params << %(alg="#{escape_structured_string(alg)}") if alg
     params << %(nonce="#{escape_structured_string(nonce)}") if nonce
+    params << %(tag="#{escape_structured_string(tag)}") if tag
 
     signature_params = "(#{component_tokens});#{params.join(";")}"
     signature_input_header = "#{label}=#{signature_params}"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http_signature
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Joel Larsson