From e08ec7a723724c247d9bbcdbf157da08d3ba31a7 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Fri, 6 May 2022 15:11:54 +0200 Subject: Handle HTTP signature draft 11 --- server/helpers/peertube-crypto.ts | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'server/helpers/peertube-crypto.ts') diff --git a/server/helpers/peertube-crypto.ts b/server/helpers/peertube-crypto.ts index b8f7c782a..1a7ee24a7 100644 --- a/server/helpers/peertube-crypto.ts +++ b/server/helpers/peertube-crypto.ts @@ -51,11 +51,18 @@ function isHTTPSignatureVerified (httpSignatureParsed: any, actor: MActor): bool } function parseHTTPSignature (req: Request, clockSkew?: number) { - const headers = req.method === 'POST' - ? HTTP_SIGNATURE.REQUIRED_HEADERS.POST - : HTTP_SIGNATURE.REQUIRED_HEADERS.ALL + const requiredHeaders = req.method === 'POST' + ? [ '(request-target)', 'host', 'digest' ] + : [ '(request-target)', 'host' ] - return httpSignature.parse(req, { clockSkew, headers }) + const parsed = httpSignature.parse(req, { clockSkew, headers: requiredHeaders }) + + const parsedHeaders = parsed.params.headers + if (!parsedHeaders.includes('date') && !parsedHeaders.includes('(created)')) { + throw new Error(`date or (created) must be included in signature`) + } + + return parsed } // JSONLD -- cgit v1.2.3