module GraphQLAuthorizer::Validator::Signature

Module for Validating Signature

Public Instance Methods

request_signature_is_valid?(sig:, timestamp:) click to toggle source
# File lib/graphql_authorizer/validator/signature.rb, line 7
def request_signature_is_valid?(sig:, timestamp:)
  access_key    = GraphQLAuthorizer.configuration.access_key
  digest        = OpenSSL::Digest.new("sha256")
  generated_sig = OpenSSL::HMAC.hexdigest(digest, access_key, timestamp)

  secure_compare(generated_sig, sig)
end

Private Instance Methods

secure_compare(a, b) click to toggle source

www.rubydoc.info/github/plataformatec/devise/Devise.secure_compare

# File lib/graphql_authorizer/validator/signature.rb, line 18
def secure_compare(a, b)
  return false if a.empty? || b.empty? || a.bytesize != b.bytesize
  l = a.unpack "C#{a.bytesize}"

  res = 0
  b.each_byte { |byte| res |= byte ^ l.shift }
  res == 0
end