signed

Overview ¶

Package signed creates and verifies signed URLs: links that carry an expiry and an HMAC-SHA256 signature over their path and query, for email verification, unsubscribe links or temporary downloads.

key, err := app.DeriveKey("signed.urls", 32) // fails without APP_KEY
if err != nil {
	return err
}

s := signed.New(key).
	WithPreviousKeys(app.DerivePreviousKeys("signed.urls", 32)...).
	WithClock(app.Now)
link, _ := s.Sign(appURL+"/email/verify/42", time.Hour)
r.Get("/email/verify/{id}", verify).Use(s.Middleware())

Signer.Verify checks a request in constant time and returns ErrInvalid or ErrExpired; Signer.Middleware answers 403 for both. Signer.Token and Signer.Open sign and verify opaque payloads, such as pagination cursors, with the same keys.

See https://github.com/AlexGalhardo/vukem/blob/main/docs/security.md.

package main

import (
	"bytes"
	"fmt"
	"net/http"
	"net/http/httptest"
	"strings"
	"time"

	"github.com/AlexGalhardo/vukem/signed"
)

func main() {
	// In an app, derive the key: app.Key.Derive("signed.urls", 32).
	s := signed.New(bytes.Repeat([]byte{3}, 32))

	link, err := s.Sign("https://example.com/email/verify/42", time.Hour)
	if err != nil {
		fmt.Println(err)
		return
	}

	ok := httptest.NewRequest(http.MethodGet, link, http.NoBody)
	fmt.Println(s.Verify(ok) == nil)

	tampered := httptest.NewRequest(http.MethodGet, strings.Replace(link, "/42", "/43", 1), http.NoBody)
	fmt.Println(s.Verify(tampered) == nil)
}

Output:
true
false