The Wagoe-Signature header: t=<unix seconds>,v1=<hex HMAC-SHA256> over
<t>.<body>. Signing the timestamp with the body is what stops a captured
request being replayed later: the receiver refuses an old t, and cannot be
handed a new t with the old signature.
The `Wagoe-Signature` header: `t=<unix seconds>,v1=<hex HMAC-SHA256>` over `<t>.<body>`. Signing the timestamp with the body is what stops a captured request being replayed later: the receiver refuses an old `t`, and cannot be handed a new `t` with the old signature.
How old a signature a receiver accepts, by default.
How old a signature a receiver accepts, by default.
(parse-header header){:t long :v1 [hex ...]} from a header value, or nil when it has no
timestamp or no v1 signature. Several v1 values are allowed, so a sender can
sign with an old and a new secret while one is rotated.
`{:t long :v1 [hex ...]}` from a header value, or nil when it has no
timestamp or no v1 signature. Several v1 values are allowed, so a sender can
sign with an old and a new secret while one is rotated.(signature-header secret timestamp body)The header value for body signed with secret at timestamp (seconds).
The header value for `body` signed with `secret` at `timestamp` (seconds).
(signature-problem secret
body
header
now
{:keys [tolerance-s] :or {tolerance-s default-tolerance-s}})Why header does not authenticate body under secret at now (seconds),
or nil when it does: :malformed, :stale or :mismatch.
Why `header` does not authenticate `body` under `secret` at `now` (seconds), or nil when it does: `:malformed`, `:stale` or `:mismatch`.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |