class Colossus::Verifier

Implements the verification logic based on SHA1 in order to avoid timing attacks. (cf Faye doc)

Attributes

secret[R]
sha1[R]
writer_token[R]

Public Class Methods

new(secret = Colossus.config.secret_key, writer_token = Colossus.config.writer_token) click to toggle source
# File lib/colossus/verifier.rb, line 7
def initialize(secret = Colossus.config.secret_key,
               writer_token = Colossus.config.writer_token)
  @sha1         = OpenSSL::Digest.new('sha1')
  @secret       = secret
  @writer_token = writer_token
end

Public Instance Methods

generate_user_token(user_id) click to toggle source
# File lib/colossus/verifier.rb, line 27
def generate_user_token(user_id)
   OpenSSL::HMAC.hexdigest(sha1, secret, user_id)
end
verify_token(token_given, user_id) click to toggle source
# File lib/colossus/verifier.rb, line 14
def verify_token(token_given, user_id)
  expected_token = generate_user_token(user_id)
  expected_hash  = Digest::SHA1.hexdigest(expected_token)
  actual_hash    = Digest::SHA1.hexdigest(token_given)
  expected_hash == actual_hash
end
verify_writer_token(token_given) click to toggle source
# File lib/colossus/verifier.rb, line 21
def verify_writer_token(token_given)
  expected_hash  = Digest::SHA1.hexdigest(writer_token)
  actual_hash    = Digest::SHA1.hexdigest(token_given)
  expected_hash == actual_hash
end