hmac.go

package jwt

import (
"crypto"
"crypto/hmac"
"errors"
)

// SigningMethodHMAC implements the HMAC-SHA family of signing methods.
// Expects key type of []byte for both signing and validation
typeSigningMethodHMACstruct {
Namestring
Hash crypto.Hash
}

// Specific instances for HS256 and company
var (
SigningMethodHS256*SigningMethodHMAC
SigningMethodHS384*SigningMethodHMAC
SigningMethodHS512*SigningMethodHMAC
ErrSignatureInvalid=errors.New("signature is invalid")
)

funcinit() {
// HS256
SigningMethodHS256=&SigningMethodHMAC{"HS256", crypto.SHA256}
RegisterSigningMethod(SigningMethodHS256.Alg(), func() SigningMethod {
returnSigningMethodHS256
 })

// HS384
SigningMethodHS384=&SigningMethodHMAC{"HS384", crypto.SHA384}
RegisterSigningMethod(SigningMethodHS384.Alg(), func() SigningMethod {
returnSigningMethodHS384
 })

// HS512
SigningMethodHS512=&SigningMethodHMAC{"HS512", crypto.SHA512}
RegisterSigningMethod(SigningMethodHS512.Alg(), func() SigningMethod {
returnSigningMethodHS512
 })
}

func (m*SigningMethodHMAC) Alg() string {
returnm.Name
}

// Verify implements token verification for the SigningMethod. Returns nil if the signature is valid.
func (m*SigningMethodHMAC) Verify(signingString, signaturestring, keyinterface{}) error {
// Verify the key is the right type
keyBytes, ok:=key.([]byte)
if!ok {
returnErrInvalidKeyType
 }

// Decode signature, for comparison
sig, err:=DecodeSegment(signature)
iferr!=nil {
returnerr
 }

// Can we use the specified hashing method?
if!m.Hash.Available() {
returnErrHashUnavailable
 }

// This signing method is symmetric, so we validate the signature
// by reproducing the signature from the signing string and key, then
// comparing that against the provided signature.
hasher:=hmac.New(m.Hash.New, keyBytes)
hasher.Write([]byte(signingString))
if!hmac.Equal(sig, hasher.Sum(nil)) {
returnErrSignatureInvalid
 }

// No validation errors. Signature is good.
returnnil
}

// Sign implements token signing for the SigningMethod.
// Key must be []byte
func (m*SigningMethodHMAC) Sign(signingStringstring, keyinterface{}) (string, error) {
ifkeyBytes, ok:=key.([]byte); ok {
if!m.Hash.Available() {
return"", ErrHashUnavailable
 }

hasher:=hmac.New(m.Hash.New, keyBytes)
hasher.Write([]byte(signingString))

returnEncodeSegment(hasher.Sum(nil)), nil
 }

return"", ErrInvalidKeyType
}