diff options
Diffstat (limited to 'activesupport/lib/active_support/message_verifier.rb')
-rw-r--r-- | activesupport/lib/active_support/message_verifier.rb | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb index 6c46b68eaf..9a4468f73c 100644 --- a/activesupport/lib/active_support/message_verifier.rb +++ b/activesupport/lib/active_support/message_verifier.rb @@ -4,28 +4,28 @@ require 'active_support/core_ext/object/blank' module ActiveSupport # MessageVerifier makes it easy to generate and verify messages which are signed # to prevent tampering. - # + # # This is useful for cases like remember-me tokens and auto-unsubscribe links where the # session store isn't suitable or available. # # Remember Me: # cookies[:remember_me] = @verifier.generate([@user.id, 2.weeks.from_now]) - # + # # In the authentication filter: # # id, time = @verifier.verify(cookies[:remember_me]) # if time < Time.now # self.current_user = User.find(id) # end - # + # class MessageVerifier class InvalidSignature < StandardError; end - + def initialize(secret, digest = 'SHA1') @secret = secret @digest = digest end - + def verify(signed_message) raise InvalidSignature if signed_message.blank? @@ -36,12 +36,12 @@ module ActiveSupport raise InvalidSignature end end - + def generate(value) data = ActiveSupport::Base64.encode64s(Marshal.dump(value)) "#{data}--#{generate_digest(data)}" end - + private # constant-time comparison algorithm to prevent timing attacks def secure_compare(a, b) |