class FreeClimb::Utils
Public Class Methods
verify_request(requestBody, signatureHeader, signingSecret, tolerance=5*60*1000)
click to toggle source
# File lib/freeclimb/utils.rb, line 8 def self.verify_request(requestBody, signatureHeader, signingSecret, tolerance=5*60*1000) signatureArr = signatureHeader.split(',') signatureHash = {} signatureArr.each { |queryStr| hash = CGI.parse(queryStr) if (signatureHash.key?(hash.keys[0])) signatureHash[hash.keys[0]] = [signatureHash[hash.keys[0]]].append(hash.values[0][0]) else signatureHash[hash.keys[0]] = hash.values[0][0] end } currentTime = DateTime.now.strftime('%s') signatureAge = currentTime.to_i - signatureHash["t"].to_i if (tolerance < signatureAge) raise StandardError.new "Request rejected - signature's timestamp failed against current tolerance of #{tolerance} milliseconds. Signature age: #{signatureAge} milliseconds"; end data = signatureHash["t"] + "." + requestBody hmac = OpenSSL::HMAC.hexdigest('sha256', signingSecret, data) if (!signatureHash["v1"].include? hmac) raise StandardError.new "Unverified Request Signature - FreeClimb was unable to verify that this request originated from FreeClimb. If this request was unexpected, it may be from a bad actor. Please proceed with caution. If this request was expected, to fix this issue try checking for any typos or misspelling of your signing secret."; end end