Module: Qrdot

Defined in:
lib/qrdot.rb,
lib/qrdot/client.rb,
lib/qrdot/version.rb

Defined Under Namespace

Classes: AnalyticsResource, ApiError, AssetsResource, Client, DomainsResource, Error, QrResource, WebhooksResource

Constant Summary collapse

VERSION = 
"0.1.2"

Class Method Summary collapse

Class Method Details

.verify_webhook_signature(secret, raw_body, header, tolerance_sec: 300) ⇒ Object

Verify X-Qrdot-Signature: t=…,v1=… over "#t.#raw_body"



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
 
# File 'lib/qrdot.rb', line 24

def self.verify_webhook_signature(secret, raw_body, header, tolerance_sec: 300)
  parts = {}
  header.to_s.split(",").each do |piece|
    k, v = piece.strip.split("=", 2)
    parts[k] = v if k && v
  end
  t = Integer(parts["t"], exception: false)
  v1 = parts["v1"]
  return false if t.nil? || t.zero? || v1.nil? || v1.empty?
  return false if (Time.now.to_i - t).abs > tolerance_sec

  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{t}.#{raw_body}")
  return false if expected.bytesize != v1.bytesize

  res = 0
  expected.bytes.zip(v1.bytes) { |a, b| res |= a ^ b }
  res.zero?
end