onfido 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9a1f27eb9ad0741dbb6a79a47e5500a9803949e3
-  data.tar.gz: 9b372d911abceaf82a67ffa26acf94b1f39043b0
+  metadata.gz: bcac6af9dc80518231e80efa12112ef00086d6d4
+  data.tar.gz: e557c29b2dc8565d3442bffc3f088dd497d8d467
 SHA512:
-  metadata.gz: 64ec8d066f5c1001fa0ead05077135edff853704d2a36d80051da66825372df75fae278cff76cd29cdacb3bd217e71eb6a794137419c32854a653c3e71c78160
-  data.tar.gz: 020226ac91a091febf4039c3e0bde9adb0091163ec135f3f146b98a45d2c0b294788103294954cbaa18e3a48b2824969fe8db6f002a15d539d363c271de6e93a
+  metadata.gz: 7345b7bbf23647ca8322ebbf30876f3bbe38bc5f2d90826cdc28f2764a70153fc6e42024f1763226aceb12a12e8cd8cc155a715de7d5a4e4216584e6a72549a3
+  data.tar.gz: 613ec094ccec7f7b63a7c1e6a5c4dbc71a23526969b4dff0930a18aa87e2a733ce92e3aa5f7635c0caf50fc4b6ce0b61dfe0f9fe7dee4c67548017a937d344b7

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## v0.5.0, 7 June 2016
+
+- Add `Onfido::Webhook.valid?` method, for checking the signature of a webhook
+  from Onfido
+
 ## v0.4.0, 12 May 2016
 
 - BREAKING: target v2 of the Onfido API. To continue using v1, specify this

data/README.md

@@ -142,6 +142,22 @@ rescue Onfido::RequestError => e
 end
 ```
 
+## Webhooks
+
+Each webhook endpoint has a secret token, generated automatically and [exposed](https://onfido.com/documentation#register-webhook) in the API. When sending a request, Onfido includes a signature computed using the request body and this token in the `X-Signature` header.
+
+This provided signature [should](https://onfido.com/documentation#webhook-security) be compared to one you generate yourself with the token to check that a webhook is a genuine request from Onfido.
+
+```ruby
+if Onfido::Webhook.valid?(request.raw_post,
+                          request.headers["X-Signature"],
+                          ENV['ONFIDO_WEBHOOK_TOKEN'])
+  process_webhook
+else
+  render status: 498, text: "498 Token expired/invalid"
+end
+```
+
 ## Roadmap
 
 - Improve test coverage with more scenarios

data/lib/onfido.rb

@@ -2,6 +2,7 @@ require 'json'
 require 'rack'
 require 'rest-client'
 require 'open-uri'
+require 'openssl'
 
 require 'onfido/version'
 require 'onfido/configuration'

data/lib/onfido/resources/webhook.rb

@@ -14,5 +14,23 @@ module Onfido
     def all(page: 1, per_page: 20)
       get(url: url_for("webhooks?page=#{page}&per_page=#{per_page}"))
     end
+
+    # As well as being a normal resource, Onfido::Webhook also supports
+    # verifying the authenticity of a webhook by comparing the signature on the
+    # request to one computed from the body
+    def self.valid?(request_body, request_signature, token)
+      if [request_body, request_signature, token].any?(&:nil?)
+        raise ArgumentError, "A request body, request signature and token " \
+                             "must be provided"
+      end
+
+      computed_signature = generate_signature(request_body, token)
+      Rack::Utils.secure_compare(request_signature, computed_signature)
+    end
+
+    def self.generate_signature(request_body, token)
+      OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha1'), token, request_body)
+    end
+    private_class_method :generate_signature
   end
 end

data/lib/onfido/version.rb

@@ -1,3 +1,3 @@
 module Onfido
-  VERSION = '0.4.0'.freeze
+  VERSION = '0.5.0'.freeze
 end

data/spec/integrations/webhook_spec.rb

@@ -46,4 +46,46 @@ describe Onfido::Webhook do
       expect(response["webhooks"][1]["id"]).to_not be_nil
     end
   end
+
+  describe ".valid?" do
+    subject(:valid?) do
+      described_class.valid?(request_body, request_signature, token)
+    end
+
+    let(:request_body) { '{"foo":"bar"}' }
+    let(:request_signature) { 'fdab9db604d33297741b43b9fc9536028d09dca3' }
+    let(:token) { 'very_secret_token' }
+
+    it { is_expected.to be(true) }
+
+    context "with an invalid signature" do
+      let(:request_signature) { '2f3d7727ff9a32a7c87072ce514df1f6d3228bec' }
+      it { is_expected.to be(false) }
+    end
+
+    context "with a nil request signature" do
+      let(:request_signature) { nil }
+      specify { expect { valid? }.to raise_error(ArgumentError) }
+    end
+
+    context "with a token other than the one used to sign the request" do
+      let(:token) { "quite_secret_token" }
+      it { is_expected.to be(false) }
+    end
+
+    context "with a nil token" do
+      let(:token) { nil }
+      specify { expect { valid? }.to raise_error(ArgumentError) }
+    end
+
+    context "with a modified request body" do
+      let(:request_body) { '{"bar":"baz"}' }
+      it { is_expected.to be(false) }
+    end
+
+    context "with a nil request body" do
+      let(:request_body) { nil }
+      specify { expect { valid? }.to raise_error(ArgumentError) }
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: onfido
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Pericles Theodorou
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-12 00:00:00.000000000 Z
+date: 2016-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler