hhmac

README

HMAC HTTP Authentication with Go

Simple HMAC authentication for Go. This has been inspired by http://stackoverflow.com/questions/7802116/custom-http-authorization-header and http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/.

Installation

go get -v github.com/yageek/hhmac

How it works

Authenticaton Header

This authentication system use the Authorization HTTP header. The format of the header should be the following:

Authorization: HHMAC key="0PN5J17HBGZHT7JJ3X82", hash="12345678abcdef", time="1234567"

Secret provider

You have to implement a SecretProvider interface to retrieve the secret and the valid scopes for a specific user:

type MockProvider struct {
}

func (m *MockProvider) GetSecret(identifier string) (string, error) {
	return "MYSECRET", nil
}

func (m *MockProvider) GetScopes(identifier string) ([]string, error) {
	return []string{"scope1", "scope2"}, nil
}

## Validator

Then you can create a Validator:

v := NewValidator(30*time.Second, &MockProvider{}, crypto.SHA256.New)

Now, simply wrap the handler you want to protect using the Auth method.

Documentation

Index

• Variables
• type SecretProvider
• type Validator
  • func NewValidator(validTime time.Duration, provider SecretProvider, fn sign.HashFunc) *Validator
  • func (v *Validator) Auth(h http.Handler, scopes []string) http.Handler
  • func (v *Validator) HashRequest(r *http.Request, date time.Time, public string, identifier string) error
  • func (v *Validator) ValidateRequest(r *http.Request, scopes []string) error

Variables

var (
	// ErrHashInvalid is returned when hash is
	// considered invalid.
	ErrHashInvalid = errors.New("Invalid Hash")
	// ErrTokenExpires is returned when token time
	// is considerd invalid.
	ErrTokenExpires = errors.New("Token expires")
	// ErrSecretNotFound tells that no secret has been found.
	ErrSecretNotFound = errors.New("Secret not found")
	// ErrInvalidScopes tells the user has no access
	ErrInvalidScopes = errors.New("No valid scopes found")
)

Types

type SecretProvider

type SecretProvider interface {
	GetSecret(identifier string) (string, error)
	GetScopes(identifier string) ([]string, error)
}

SecretProvider helps to retrieve informations about the user.

type Validator

type Validator struct {
	// contains filtered or unexported fields
}

Validator validates request

func NewValidator

func NewValidator(validTime time.Duration, provider SecretProvider, fn sign.HashFunc) *Validator

NewValidator returns a new validator

func (*Validator) Auth

func (v *Validator) Auth(h http.Handler, scopes []string) http.Handler

Auth wraps the current handler as authenticated with the provided scopes

func (*Validator) HashRequest

func (v *Validator) HashRequest(r *http.Request, date time.Time, public string, identifier string) error

HashRequest hash the requests with the given parameters. Ex: Authorization: FIRE-TOKEN apikey="0PN5J17HBGZHT7JJ3X82", hash="frJIUN8DYpKDtOLCwo//yllqDzg=" See http://stackoverflow.com/questions/7802116/custom-http-authorization-header

func (*Validator) ValidateRequest

func (v *Validator) ValidateRequest(r *http.Request, scopes []string) error

ValidateRequest validate the requests