github.com/graybobo/golang.org-package-offline-cache@v0.0.0-20200626051047-6608995c132f/x/net/xsrftoken/xsrf.go (about)

     1  // Copyright 2012 The Go Authors.  All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Package xsrftoken provides methods for generating and validating secure XSRF tokens.
     6  package xsrftoken // import "golang.org/x/net/xsrftoken"
     7  
     8  import (
     9  	"crypto/hmac"
    10  	"crypto/sha1"
    11  	"crypto/subtle"
    12  	"encoding/base64"
    13  	"fmt"
    14  	"strconv"
    15  	"strings"
    16  	"time"
    17  )
    18  
    19  // Timeout is the duration for which XSRF tokens are valid.
    20  // It is exported so clients may set cookie timeouts that match generated tokens.
    21  const Timeout = 24 * time.Hour
    22  
    23  // clean sanitizes a string for inclusion in a token by replacing all ":"s.
    24  func clean(s string) string {
    25  	return strings.Replace(s, ":", "_", -1)
    26  }
    27  
    28  // Generate returns a URL-safe secure XSRF token that expires in 24 hours.
    29  //
    30  // key is a secret key for your application.
    31  // userID is a unique identifier for the user.
    32  // actionID is the action the user is taking (e.g. POSTing to a particular path).
    33  func Generate(key, userID, actionID string) string {
    34  	return generateTokenAtTime(key, userID, actionID, time.Now())
    35  }
    36  
    37  // generateTokenAtTime is like Generate, but returns a token that expires 24 hours from now.
    38  func generateTokenAtTime(key, userID, actionID string, now time.Time) string {
    39  	// Round time up and convert to milliseconds.
    40  	milliTime := (now.UnixNano() + 1e6 - 1) / 1e6
    41  
    42  	h := hmac.New(sha1.New, []byte(key))
    43  	fmt.Fprintf(h, "%s:%s:%d", clean(userID), clean(actionID), milliTime)
    44  
    45  	// Get the padded base64 string then removing the padding.
    46  	tok := string(h.Sum(nil))
    47  	tok = base64.URLEncoding.EncodeToString([]byte(tok))
    48  	tok = strings.TrimRight(tok, "=")
    49  
    50  	return fmt.Sprintf("%s:%d", tok, milliTime)
    51  }
    52  
    53  // Valid reports whether a token is a valid, unexpired token returned by Generate.
    54  func Valid(token, key, userID, actionID string) bool {
    55  	return validTokenAtTime(token, key, userID, actionID, time.Now())
    56  }
    57  
    58  // validTokenAtTime reports whether a token is valid at the given time.
    59  func validTokenAtTime(token, key, userID, actionID string, now time.Time) bool {
    60  	// Extract the issue time of the token.
    61  	sep := strings.LastIndex(token, ":")
    62  	if sep < 0 {
    63  		return false
    64  	}
    65  	millis, err := strconv.ParseInt(token[sep+1:], 10, 64)
    66  	if err != nil {
    67  		return false
    68  	}
    69  	issueTime := time.Unix(0, millis*1e6)
    70  
    71  	// Check that the token is not expired.
    72  	if now.Sub(issueTime) >= Timeout {
    73  		return false
    74  	}
    75  
    76  	// Check that the token is not from the future.
    77  	// Allow 1 minute grace period in case the token is being verified on a
    78  	// machine whose clock is behind the machine that issued the token.
    79  	if issueTime.After(now.Add(1 * time.Minute)) {
    80  		return false
    81  	}
    82  
    83  	expected := generateTokenAtTime(key, userID, actionID, issueTime)
    84  
    85  	// Check that the token matches the expected value.
    86  	// Use constant time comparison to avoid timing attacks.
    87  	return subtle.ConstantTimeCompare([]byte(token), []byte(expected)) == 1
    88  }