altcha-clj.verify — me.mjholub/altcha-clj 1.3.0

assoc-if-some clj/s

(assoc-if-some m)

(assoc-if-some m k v)

(assoc-if-some m k v & kvs)

Conditionally adds a key k to value v pairs to map m. If no args are present or v is nil, returns m. If passed a variadic argument of arbitrary number of kvs key-value pairs, adds each of them that is not nil to m

check-solution clj/s

(check-solution payload
                hmac-key
                check-expiration?
                &
                {:keys [max-number reference-time throw-on-false?]})

Verifies the solution received from the client, returning an explicit true or a falsy nil Params:

• payload: the map of the following keys received from the client. Note that usually you'll get the solution encoded in base-64
  • algorithm
  • challenge - the solved challenge value
  • number - the random number generated previously
  • salt
  • signature
• hmac-key - the HMAC key used for verification.
• check-expiration? - whether to check if the challenge has not expired. Recommended to be kept as true

Keys:

• max-number - optional max-number override. If you're facing issues with false negatives, try adding your value to this function's args
• reference-time - reference timestamp to compare as the timestamp which must be greater than the challenge's created-at value
• throw-on-false? - whether to throw an error if the result is false. The result will be an ex-message with params, payload, not-expired? and expected-challenge

check-solution-base64 clj/s

(check-solution-base64 b64-payload
                       hmac-key
                       check-expiration?
                       &
                       {:keys [max-number reference-time throw-on-false?]})

Verifies a base64 encoded solution. For parameters documenation, see check-solution

signature-not-expired? clj/s

(signature-not-expired? verification-data current)

verify-fields-hash clj/s

(verify-fields-hash form-data fields fields-hash algorithm)

Verify the hashes of field values in the input map. Useful for scraper protection

verify-server-signature clj/s

(verify-server-signature {:keys [algorithm verification-data signature verified]
                          :as payload}
                         hmac-key)

verify-server-signature-base64 clj/s

(verify-server-signature-base64 base64-payload hmac-key)