9 // Implements the HMAC-SHA family of signing methods signing methods
10 // Expects key type of []byte for both signing and validation
11 type SigningMethodHMAC struct {
16 // Specific instances for HS256 and company
18 SigningMethodHS256 *SigningMethodHMAC
19 SigningMethodHS384 *SigningMethodHMAC
20 SigningMethodHS512 *SigningMethodHMAC
21 ErrSignatureInvalid = errors.New("signature is invalid")
26 SigningMethodHS256 = &SigningMethodHMAC{"HS256", crypto.SHA256}
27 RegisterSigningMethod(SigningMethodHS256.Alg(), func() SigningMethod {
28 return SigningMethodHS256
32 SigningMethodHS384 = &SigningMethodHMAC{"HS384", crypto.SHA384}
33 RegisterSigningMethod(SigningMethodHS384.Alg(), func() SigningMethod {
34 return SigningMethodHS384
38 SigningMethodHS512 = &SigningMethodHMAC{"HS512", crypto.SHA512}
39 RegisterSigningMethod(SigningMethodHS512.Alg(), func() SigningMethod {
40 return SigningMethodHS512
44 func (m *SigningMethodHMAC) Alg() string {
48 // Verify the signature of HSXXX tokens. Returns nil if the signature is valid.
49 func (m *SigningMethodHMAC) Verify(signingString, signature string, key interface{}) error {
50 // Verify the key is the right type
51 keyBytes, ok := key.([]byte)
53 return ErrInvalidKeyType
56 // Decode signature, for comparison
57 sig, err := DecodeSegment(signature)
62 // Can we use the specified hashing method?
63 if !m.Hash.Available() {
64 return ErrHashUnavailable
67 // This signing method is symmetric, so we validate the signature
68 // by reproducing the signature from the signing string and key, then
69 // comparing that against the provided signature.
70 hasher := hmac.New(m.Hash.New, keyBytes)
71 hasher.Write([]byte(signingString))
72 if !hmac.Equal(sig, hasher.Sum(nil)) {
73 return ErrSignatureInvalid
76 // No validation errors. Signature is good.
80 // Implements the Sign method from SigningMethod for this signing method.
82 func (m *SigningMethodHMAC) Sign(signingString string, key interface{}) (string, error) {
83 if keyBytes, ok := key.([]byte); ok {
84 if !m.Hash.Available() {
85 return "", ErrHashUnavailable
88 hasher := hmac.New(m.Hash.New, keyBytes)
89 hasher.Write([]byte(signingString))
91 return EncodeSegment(hasher.Sum(nil)), nil
94 return "", ErrInvalidKeyType