class Bollard::Token

Attributes

signing_secret[R]
token[R]

Public Class Methods

generate(payload, signing_secret, ttl: 600) click to toggle source

Generate the token header for a given payload. The token becomes invalid after `ttl` seconds.

Returns a JWT with an iat, exp, and signature data

# File lib/bollard/token.rb, line 12
def self.generate(payload, signing_secret, ttl: 600)
  iat = Time.now.to_i
  signature = Signature.calculate_signature(payload)
  jwt_payload = { iat: iat, exp: iat + ttl, Signature::EXPECTED_ALGORITHM => signature }
  JWT.encode(jwt_payload, signing_secret, 'HS256')
end
new(token, signing_secret) click to toggle source
# File lib/bollard/token.rb, line 20
def initialize(token, signing_secret)
  @token = token
  @signing_secret = signing_secret
end

Public Instance Methods

verify_payload(payload, tolerance: nil) click to toggle source

Verifies the token header for a given payload.

Raises a SignatureVerificationError in the following cases:

  • the header does not match the expected format

  • no hash found with the expected algorithm

  • hash doesn't match the expected hash

Returns true otherwise

# File lib/bollard/token.rb, line 34
def verify_payload(payload, tolerance: nil)
  token_data, header = decode_token(tolerance)
  signature = extract_signature(token_data)
  verify_data(signature, payload)

  true
end

Private Instance Methods

decode_token(tolerance) click to toggle source
# File lib/bollard/token.rb, line 47
def decode_token(tolerance)
  JWT.decode(token, signing_secret, true, { exp_leeway: tolerance })
rescue JWT::DecodeError => e
  raise SignatureVerificationError.new(e.message)
end
extract_signature(token_data) click to toggle source
# File lib/bollard/token.rb, line 53
def extract_signature(token_data)
  signature = token_data[Signature::EXPECTED_ALGORITHM]
  return Signature.new(signature) unless signature.blank?
  raise SignatureVerificationError.new("No signature found with expected algorithm #{Signature::EXPECTED_ALGORITHM}")
end
verify_data(signature, payload) click to toggle source
# File lib/bollard/token.rb, line 59
def verify_data(signature, payload)
  return true if signature.match?(payload)
  raise SignatureVerificationError.new("Hash mismatch for payload")
end