oo_auth 0.1.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fe4f72cf83013da415eb05cc8290d49e6c3843d2
-  data.tar.gz: d5c7bbc222785702e4a8f9a31ef1ec6643d449e2
+  metadata.gz: 441d2379fc013ddf3adce0b440ef0567db4de48d
+  data.tar.gz: c592574f18c131f429c98891b39c8ddeb43e4ca4
 SHA512:
-  metadata.gz: 5af4e5b5e6f7199d347c4649839b06322474eaf4beffb999b7561735c8e067dc9e60011840fdc62bbb29d3367ed713a0c1dd47fe07b05da057d3b62c25a66ade
-  data.tar.gz: d2858ce8aba4946e5d002652b97965ac8ed4ec2ec21d4c6b71b4d0b4e70b3b3b8c805f5b24831cec6f1b42596019d670f7a0c91c119f8efb7ed554fa80fa85af
+  metadata.gz: b381458ece7b62946c65519decb18570ee99d1bcb947bdaa0730b07e93725effa0854a806525c95c717b07ceeb4c07eb67308f51f5de28d011b605d83e1f43e9
+  data.tar.gz: 957176994113082efd5233c225a7828023773b0cc3bc1a10dab98fe55ebb8711a4b2ad408fa075e2293bc114b85c1a3e63256df48bec38921e4c59b918df5c29

data/CHANGELOG

@@ -1,3 +1,7 @@
+1.0.0 - 2015-11-16
+
+* Support HMAC-SHA256
+
 0.0.1 - 2013-11-06
 
 * First release

data/README.md

@@ -47,10 +47,12 @@ request['Authorization']
 
 ### OAuth provider
 
+In your Rails API controller:
+
 ```ruby
 class ApiController < ApplicationController
 
-  before_filter :oauth_required
+  before_action :oauth_required
 
   private
   
@@ -71,7 +73,7 @@ OoAuth requires your provider application to provide stores for authorization to
 and OAuth nonces. (You won't need these stores if you're only using OoAuth's client
 functionality.)
 
-OoAuth stores can be as simple lambdas or regular ruby objects.
+OoAuth stores can be simple lambdas or regular ruby objects.
 
 ### Authorization store
 
@@ -139,6 +141,32 @@ require 'oo_auth/nonce/redis_store'
 OoAuth.nonce_store = OoAuth::Nonce::RedisStore.new(namespace: 'foobar')
 ```
 
+## Configuring signature methods
+
+The available signature methods can be configured using a setter which accepts
+signature method names as strings or symbols:
+
+```ruby
+# config/initializers/oo_auth.rb
+OoAuth.signature_methods = [:hmac_sha1, 'HMAC-SHA256', :hmac_sha512]
+```
+
+The default signature method OoAuth will use to sign requests is `HMAC-SHA1`.
+It can be set to any of the supported methods using
+
+```ruby
+OoAuth.signature_method = :hmac_sha256
+```
+
+As using `HMAC-SHA1` is no longer recommended, you can disable it altogether:
+
+```ruby
+# disable HMAC-SHA1 completely
+OoAuth.signature_methods = [:hmac_sha256]
+```
+
+A provider configured this way will only accept `HMAC-SHA256` signatures.
+
 ## TODO
 
 * Support POST body signing for non-formencoded data

data/lib/oo_auth.rb

@@ -5,7 +5,7 @@ require 'base64'
 
 require 'oo_auth/version'
 require 'oo_auth/constants'
-require 'oo_auth/configuration_error'
+require 'oo_auth/errors'
 require 'oo_auth/nonce'
 require 'oo_auth/nonce/abstract_store'
 require 'oo_auth/request_proxy'
@@ -18,7 +18,6 @@ module OoAuth
     # Initialize with instance of store
     # OoAuth.nonce_store = OoAuth::Nonce::RedisStore.new(namespace: 'foo')
     attr_accessor :nonce_store
-
   
     # Define a lookup method for access token verification
     # It should be callable (proc) or provide an +authorization+ method,
@@ -31,6 +30,42 @@ module OoAuth
     # - nil otherwise.
     attr_accessor :authorization_store
     
+    def signature_methods
+      @signature_methods ||= SUPPORTED_SIGNATURE_METHODS
+    end
+    
+    # Set the available signature methods
+    # You can either use strings or symbols, e.g.
+    # ['HMAC_SHA1', :hmac_sha256]
+    def signature_methods=(methods)
+      @signature_methods = methods.collect do |method|
+        method = method.to_s.upcase.sub('_', '-')
+        raise UnsupportedSignatureMethod, method.inspect unless SUPPORTED_SIGNATURE_METHODS.include?(method)
+        method
+      end
+    end
+    
+    # Check if the signature method is valid, raise error if not
+    #
+    # Supported values:
+    # - 'HMAC-SHA1'
+    # - 'HMAC-SHA256'
+    # - 'HMAC-SHA512'
+    #
+    def verify_signature_method!(value)
+      raise UnsupportedSignatureMethod, value.inspect unless signature_methods.include?(value)
+    end
+    
+    def signature_method
+      @signature_method ||= DEFAULT_SIGNATURE_METHOD
+    end
+
+    # Set the signature method to use
+    def signature_method=(value)
+      verify_signature_method!(value)
+      @signature_method = value
+    end
+    
     # Generate a random key of up to +size+ bytes. The value returned is Base64 encoded with non-word
     # characters removed.
     def generate_key(size = 32)
@@ -78,7 +113,7 @@ module OoAuth
       credentials = args.pop
       proxy = RequestProxy.new(*args)
       Signature.sign!(proxy, credentials)
-    end      
+    end
     
     # Use this in your controllers to verify the OAuth signature
     # of a request.

data/lib/oo_auth/constants.rb

@@ -1,5 +1,4 @@
 module OoAuth
-  
   # request tokens are passed between the consumer and the provider out of
   # band (i.e. callbacks cannot be used), per section 6.1.1
   OUT_OF_BAND = 'oob'
@@ -11,9 +10,16 @@ module OoAuth
   # reserved character regexp, per section 5.1
   RESERVED_CHARACTERS = /[^a-zA-Z0-9\-\.\_\~]/
   
-  # OoAuth only supports HMAC-SHA1
-  SIGNATURE_METHOD = 'HMAC-SHA1'
+  # Supported signature methods
+  HMAC_SHA1 = 'HMAC-SHA1'
+  HMAC_SHA256 = 'HMAC-SHA256'
+  HMAC_SHA512 = 'HMAC-SHA512'
   
-  MAX_TIMESTAMP_DEVIATION = 5 * 60
+  SUPPORTED_SIGNATURE_METHODS = { HMAC_SHA1   => OpenSSL::Digest::SHA1,
+                                  HMAC_SHA256 => OpenSSL::Digest::SHA256,
+                                  HMAC_SHA512 => OpenSSL::Digest::SHA512 }
   
-end
+  DEFAULT_SIGNATURE_METHOD = HMAC_SHA1
+  
+  MAX_TIMESTAMP_DEVIATION = 5 * 60
+end

data/lib/oo_auth/errors.rb

@@ -0,0 +1,5 @@
+module OoAuth
+  class Error < StandardError; end
+  class ConfigurationError < Error; end
+  class UnsupportedSignatureMethod < Error; end
+end

data/lib/oo_auth/signature.rb

@@ -2,25 +2,21 @@ module OoAuth
   module Signature
 
     class << self
-      def hmac_sha1_signature(base_string, consumer_secret, token_secret)
-        Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::SHA1.new, OoAuth.encode(consumer_secret, token_secret), base_string))
-      end
-
-      def calculate_signature(proxy, credentials, params)
-        hmac_sha1_signature(proxy.signature_base_string(params), credentials.consumer_secret, credentials.token_secret)
-      end
-
-      def sign!(proxy, credentials)
+      
+      def sign!(proxy, credentials, signature_method = OoAuth.signature_method)
+        signature_method = signature_method.to_s.upcase.sub('_', '-') if signature_method.is_a?(Symbol)
+        OoAuth.verify_signature_method!(signature_method)
+        
         params = {
           oauth_version: '1.0',
           oauth_nonce: OoAuth.generate_nonce,
           oauth_timestamp: OoAuth.timestamp,
-          oauth_signature_method: SIGNATURE_METHOD,
+          oauth_signature_method: signature_method,
           oauth_consumer_key: credentials.consumer_key,
           oauth_token: credentials.token
         }
       
-        params[:oauth_signature] = calculate_signature(proxy, credentials, params)
+        params[:oauth_signature] = calculate_signature(proxy, credentials, params, signature_method)
 
         proxy.authorization = authorization_header(params)
       end
@@ -28,7 +24,7 @@ module OoAuth
       # Check signature validity without remembering nonce - DO NOT use to authorize actual requests
       def valid?(proxy, credentials)
         verify_timestamp!(proxy) &&
-        calculate_signature(proxy, credentials, proxy.oauth_params_without_signature) == proxy.signature
+        calculate_signature(proxy, credentials, proxy.oauth_params_without_signature, proxy.signature_method) == proxy.signature
       end
       
       # Verify signature and remember nonce - use this to authorize actual requests
@@ -50,6 +46,18 @@ module OoAuth
         'OAuth ' + params.map { |k, v| "#{OoAuth.escape(k)}=\"#{OoAuth.escape(v)}\"" }.join(', ')
       end
       
+      def calculate_signature(proxy, credentials, params, signature_method)
+        hmac_signature(signature_method, proxy.signature_base_string(params), credentials.consumer_secret, credentials.token_secret)
+      end
+      
+      def hmac_signature(signature_method, base_string, consumer_secret, token_secret)
+        Base64.strict_encode64(OpenSSL::HMAC.digest(signature_algorithm(signature_method).new, OoAuth.encode(consumer_secret, token_secret), base_string))
+      end
+      
+      def signature_algorithm(signature_method)
+        OoAuth.verify_signature_method!(signature_method)
+        SUPPORTED_SIGNATURE_METHODS[signature_method]
+      end
     end
   end
-end
+end

data/lib/oo_auth/version.rb

@@ -1,3 +1,3 @@
 module OoAuth
-  VERSION = '0.1.0'
+  VERSION = '1.0.0'
 end

metadata

@@ -1,83 +1,83 @@
 --- !ruby/object:Gem::Specification
 name: oo_auth
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Matthias Grosser
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-11-04 00:00:00.000000000 Z
+date: 2015-11-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.8.7
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.8.7
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '4.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '4.7'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.6.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.6.3
 description: Out Of Band OAuth
@@ -86,19 +86,19 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG
+- LICENSE
+- README.md
 - lib/oo_auth.rb
-- lib/oo_auth/request_proxy.rb
 - lib/oo_auth/constants.rb
-- lib/oo_auth/configuration_error.rb
-- lib/oo_auth/version.rb
 - lib/oo_auth/credentials.rb
+- lib/oo_auth/errors.rb
 - lib/oo_auth/nonce.rb
-- lib/oo_auth/signature.rb
 - lib/oo_auth/nonce/abstract_store.rb
 - lib/oo_auth/nonce/redis_store.rb
-- LICENSE
-- README.md
-- CHANGELOG
+- lib/oo_auth/request_proxy.rb
+- lib/oo_auth/signature.rb
+- lib/oo_auth/version.rb
 homepage: http://github.com/mtgrosser/oo_auth
 licenses:
 - MIT
@@ -109,17 +109,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.3
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: OAuth without the callbacks

data/lib/oo_auth/configuration_error.rb

@@ -1,3 +0,0 @@
-module OoAuth
-  class ConfigurationError < StandardError; end
-end