Allow for non-string HMAC keys (#98)

CHANGES.md

@@ -4,6 +4,10 @@
 
 (nothing yet)
 
+## 1.3.2
+
+- Allow Buffers to be used for verifyHMAC (#98)
+
 ## 1.3.1
 
 - Fix node 0.10 usage (#90)

lib/verify.js

@@ -44,14 +44,14 @@ module.exports = {
    * that was returned from `parse()`.
    *
    * @param {Object} parsedSignature the object you got from `parse`.
-   * @param {String} secret HMAC shared secret.
+   * @param {String} or {Buffer} secret HMAC shared secret.
    * @return {Boolean} true if valid, false otherwise.
    * @throws {TypeError} if you pass in bad arguments.
    * @throws {InvalidAlgorithmError}
    */
   verifyHMAC: function verifyHMAC(parsedSignature, secret) {
     assert.object(parsedSignature, 'parsedHMAC');
-    assert.string(secret, 'secret');
+    assert(typeof (secret) === 'string' || secret instanceof Buffer);
 
     var alg = validateAlgorithm(parsedSignature.algorithm);
     if (alg[0] !== 'hmac')

package.json

@@ -1,7 +1,7 @@
 {
   "name": "http-signature",
   "description": "Reference implementation of Joyent's HTTP Signature scheme.",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "license": "MIT",
   "author": "Joyent, Inc",
   "contributors": [

test/verify.test.js

@@ -16,6 +16,7 @@ var httpSignature = require('../lib/index');
 ///--- Globals
 
 var hmacKey = null;
+var rawhmacKey = null;
 var options = null;
 var rsaPrivate = null;
 var rsaPublic = null;
@@ -45,6 +46,8 @@ test('setup', function(t) {
   t.ok(ecdsaPublic);
 
   hmacKey = uuid();
+  rawhmacKey = crypto.randomBytes(64);
+
   socket = '/tmp/.' + uuid();
   options = {
     socketPath: socket,
@@ -107,6 +110,49 @@ test('valid hmac', function(t) {
   });
 });
 
+test('invalid raw hmac', function(t) {
+  server.tester = function(req, res) {
+    var parsed = httpSignature.parseRequest(req);
+    t.ok(!httpSignature.verifyHMAC(parsed, rawhmacKey));
+
+    res.writeHead(200);
+    res.write(JSON.stringify(parsed, null, 2));
+    res.end();
+  };
+
+  options.headers.Date = jsprim.rfc1123(new Date());
+  options.headers.Authorization =
+    'Signature keyId="foo",algorithm="hmac-sha1",signature="' +
+     uuid() + '"';
+
+  http.get(options, function(res) {
+    t.equal(res.statusCode, 200);
+    t.end();
+  });
+});
+
+test('valid raw hmac', function(t) {
+  server.tester = function(req, res) {
+    var parsed = httpSignature.parseRequest(req);
+    t.ok(httpSignature.verifyHMAC(parsed, rawhmacKey));
+
+    res.writeHead(200);
+    res.write(JSON.stringify(parsed, null, 2));
+    res.end();
+  };
+
+  options.headers.Date = jsprim.rfc1123(new Date());
+  var hmac = crypto.createHmac('sha1', rawhmacKey);
+  hmac.update('date: ' + options.headers.Date);
+  options.headers.Authorization =
+    'Signature keyId="foo",algorithm="hmac-sha1",signature="' +
+    hmac.digest('base64') + '"';
+
+  http.get(options, function(res) {
+    t.equal(res.statusCode, 200);
+    t.end();
+  });
+});
 
 test('invalid rsa', function(t) {
   server.tester = function(req, res) {