xsrf.go

Documentation: golang.org/x/net/xsrftoken

     1  // Copyright 2012 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Package xsrftoken provides methods for generating and validating secure XSRF tokens.
     6  package xsrftoken // import "golang.org/x/net/xsrftoken"
     7  
     8  import (
     9  	"crypto/hmac"
    10  	"crypto/sha1"
    11  	"crypto/subtle"
    12  	"encoding/base64"
    13  	"fmt"
    14  	"strconv"
    15  	"strings"
    16  	"time"
    17  )
    18  
    19  // Timeout is the duration for which XSRF tokens are valid.
    20  // It is exported so clients may set cookie timeouts that match generated tokens.
    21  const Timeout = 24 * time.Hour
    22  
    23  // clean sanitizes a string for inclusion in a token by replacing all ":" with "::".
    24  func clean(s string) string {
    25  	return strings.Replace(s, `:`, `::`, -1)
    26  }
    27  
    28  // Generate returns a URL-safe secure XSRF token that expires in 24 hours.
    29  //
    30  // key is a secret key for your application; it must be non-empty.
    31  // userID is an optional unique identifier for the user.
    32  // actionID is an optional action the user is taking (e.g. POSTing to a particular path).
    33  func Generate(key, userID, actionID string) string {
    34  	return generateTokenAtTime(key, userID, actionID, time.Now())
    35  }
    36  
    37  // generateTokenAtTime is like Generate, but returns a token that expires 24 hours from now.
    38  func generateTokenAtTime(key, userID, actionID string, now time.Time) string {
    39  	if len(key) == 0 {
    40  		panic("zero length xsrf secret key")
    41  	}
    42  	// Round time up and convert to milliseconds.
    43  	milliTime := (now.UnixNano() + 1e6 - 1) / 1e6
    44  
    45  	h := hmac.New(sha1.New, []byte(key))
    46  	fmt.Fprintf(h, "%s:%s:%d", clean(userID), clean(actionID), milliTime)
    47  
    48  	// Get the no padding base64 string.
    49  	tok := string(h.Sum(nil))
    50  	tok = base64.RawURLEncoding.EncodeToString([]byte(tok))
    51  
    52  	return fmt.Sprintf("%s:%d", tok, milliTime)
    53  }
    54  
    55  // Valid reports whether a token is a valid, unexpired token returned by Generate.
    56  // The token is considered to be expired and invalid if it is older than the default Timeout.
    57  func Valid(token, key, userID, actionID string) bool {
    58  	return validTokenAtTime(token, key, userID, actionID, time.Now(), Timeout)
    59  }
    60  
    61  // ValidFor reports whether a token is a valid, unexpired token returned by Generate.
    62  // The token is considered to be expired and invalid if it is older than the timeout duration.
    63  func ValidFor(token, key, userID, actionID string, timeout time.Duration) bool {
    64  	return validTokenAtTime(token, key, userID, actionID, time.Now(), timeout)
    65  }
    66  
    67  // validTokenAtTime reports whether a token is valid at the given time.
    68  func validTokenAtTime(token, key, userID, actionID string, now time.Time, timeout time.Duration) bool {
    69  	if len(key) == 0 {
    70  		panic("zero length xsrf secret key")
    71  	}
    72  	// Extract the issue time of the token.
    73  	sep := strings.LastIndex(token, ":")
    74  	if sep < 0 {
    75  		return false
    76  	}
    77  	millis, err := strconv.ParseInt(token[sep+1:], 10, 64)
    78  	if err != nil {
    79  		return false
    80  	}
    81  	issueTime := time.Unix(0, millis*1e6)
    82  
    83  	// Check that the token is not expired.
    84  	if now.Sub(issueTime) >= timeout {
    85  		return false
    86  	}
    87  
    88  	// Check that the token is not from the future.
    89  	// Allow 1 minute grace period in case the token is being verified on a
    90  	// machine whose clock is behind the machine that issued the token.
    91  	if issueTime.After(now.Add(1 * time.Minute)) {
    92  		return false
    93  	}
    94  
    95  	expected := generateTokenAtTime(key, userID, actionID, issueTime)
    96  
    97  	// Check that the token matches the expected value.
    98  	// Use constant time comparison to avoid timing attacks.
    99  	return subtle.ConstantTimeCompare([]byte(token), []byte(expected)) == 1
   100  }
   101
View as plain text