class Shrine::UrlSigner

Public Class Methods

Source

# File lib/shrine/plugins/derivation_endpoint.rb
714 def initialize(secret_key)
715   @secret_key = secret_key
716 end

Public Instance Methods

generate_signature (string)

Source

# File lib/shrine/plugins/derivation_endpoint.rb
753 def generate_signature(string)
754   OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, secret_key, string)
755 end

Uses HMAC-SHA-256 algorithm to generate a signature from the given string using the secret key.

sign_url (url)

Source

# File lib/shrine/plugins/derivation_endpoint.rb
719 def sign_url(url)
720   path, query = url.split("?", 2)
721 
722   signature = generate_signature("#{path}?#{query}")
723   query     = [query, "signature=#{signature}"].reject { |part| part.to_s.empty? }.join("&")
724 
725   "#{path}?#{query}"
726 end

Returns a URL with the signature query parameter

verify_signature (string, signature)

Source

# File lib/shrine/plugins/derivation_endpoint.rb
743 def verify_signature(string, signature)
744   if signature.nil?
745     fail InvalidSignature, "missing \"signature\" param"
746   elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
747     fail InvalidSignature, "provided signature does not match the calculated signature"
748   end
749 end

verify_url (url)

Source

# File lib/shrine/plugins/derivation_endpoint.rb
734 def verify_url(url)
735   path, query = url.split("?", 2)
736 
737   params    = query.to_s.split("&", -1)
738   signature = params.pop.delete_prefix("signature=") if params.last&.start_with?("signature=")
739 
740   verify_signature("#{path}?#{params.join("&")}", signature)
741 end

Calculates the signature from the URL and checks whether it matches the value in the trailing signature query parameter. Raises InvalidSignature if the signature parameter is missing or its value doesn’t match the calculated signature. The URL is verified as is, without any normalization, so that each signed URL has only one valid form (otherwise variants of it could be used to bypass CDN caching).