관리-도구

편집 파일: browser.js

'use strict';

/*
    HTTP Hawk Authentication Scheme
    Copyright (c) 2012-2016, Eran Hammer <eran@hammer.io>
    BSD Licensed
*/

// Declare namespace

var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; };

var hawk = {
    internals: {}
};

hawk.client = {

// Generate an Authorization header for a given request

/*
        uri: 'http://example.com/resource?a=b' or object generated by hawk.utils.parseUri()
        method: HTTP verb (e.g. 'GET', 'POST')
        options: {
             // Required
             credentials: {
                id: 'dh37fgj492je',
                key: 'aoijedoaijsdlaksjdl',
                algorithm: 'sha256'                                 // 'sha1', 'sha256'
            },
             // Optional
             ext: 'application-specific',                        // Application specific data sent via the ext attribute
            timestamp: Date.now() / 1000,                       // A pre-calculated timestamp in seconds
            nonce: '2334f34f',                                  // A pre-generated nonce
            localtimeOffsetMsec: 400,                           // Time offset to sync with server time (ignored if timestamp provided)
            payload: '{"some":"payload"}',                      // UTF-8 encoded string for body hash generation (ignored if hash provided)
            contentType: 'application/json',                    // Payload content-type (ignored if hash provided)
            hash: 'U4MKKSmiVxk37JCCrAVIjV=',                    // Pre-calculated payload hash
            app: '24s23423f34dx',                               // Oz application id
            dlg: '234sz34tww3sd'                                // Oz delegated-by application id
        }
    */

header: function header(uri, method, options) {

var result = {
            field: '',
            artifacts: {}
        };

// Validate inputs

if (!uri || typeof uri !== 'string' && (typeof uri === 'undefined' ? 'undefined' : _typeof(uri)) !== 'object' || !method || typeof method !== 'string' || !options || (typeof options === 'undefined' ? 'undefined' : _typeof(options)) !== 'object') {

result.err = 'Invalid argument type';
            return result;
        }

// Application time

var timestamp = options.timestamp || hawk.utils.nowSec(options.localtimeOffsetMsec);

// Validate credentials

var credentials = options.credentials;
        if (!credentials || !credentials.id || !credentials.key || !credentials.algorithm) {

result.err = 'Invalid credentials object';
            return result;
        }

if (hawk.crypto.algorithms.indexOf(credentials.algorithm) === -1) {
            result.err = 'Unknown algorithm';
            return result;
        }

// Parse URI

if (typeof uri === 'string') {
            uri = hawk.utils.parseUri(uri);
        }

// Calculate signature

var artifacts = {
            ts: timestamp,
            nonce: options.nonce || hawk.utils.randomString(6),
            method: method,
            resource: uri.resource,
            host: uri.host,
            port: uri.port,
            hash: options.hash,
            ext: options.ext,
            app: options.app,
            dlg: options.dlg
        };

result.artifacts = artifacts;

// Calculate payload hash

if (!artifacts.hash && (options.payload || options.payload === '')) {

artifacts.hash = hawk.crypto.calculatePayloadHash(options.payload, credentials.algorithm, options.contentType);
        }

var mac = hawk.crypto.calculateMac('header', credentials, artifacts);

// Construct header

var hasExt = artifacts.ext !== null && artifacts.ext !== undefined && artifacts.ext !== ''; // Other falsey values allowed
        var header = 'Hawk id="' + credentials.id + '", ts="' + artifacts.ts + '", nonce="' + artifacts.nonce + (artifacts.hash ? '", hash="' + artifacts.hash : '') + (hasExt ? '", ext="' + hawk.utils.escapeHeaderAttribute(artifacts.ext) : '') + '", mac="' + mac + '"';

if (artifacts.app) {
            header += ', app="' + artifacts.app + (artifacts.dlg ? '", dlg="' + artifacts.dlg : '') + '"';
        }

result.field = header;

return result;
    },

// Generate a bewit value for a given URI

/*
        uri: 'http://example.com/resource?a=b'
        options: {
             // Required
             credentials: {
            id: 'dh37fgj492je',
            key: 'aoijedoaijsdlaksjdl',
            algorithm: 'sha256'                             // 'sha1', 'sha256'
            },
            ttlSec: 60 * 60,                                    // TTL in seconds
             // Optional
             ext: 'application-specific',                        // Application specific data sent via the ext attribute
            localtimeOffsetMsec: 400                            // Time offset to sync with server time
         };
    */

bewit: function bewit(uri, options) {

// Validate inputs

if (!uri || typeof uri !== 'string' || !options || (typeof options === 'undefined' ? 'undefined' : _typeof(options)) !== 'object' || !options.ttlSec) {

return '';
        }

options.ext = options.ext === null || options.ext === undefined ? '' : options.ext; // Zero is valid value

// Application time

var now = hawk.utils.nowSec(options.localtimeOffsetMsec);

// Validate credentials

var credentials = options.credentials;
        if (!credentials || !credentials.id || !credentials.key || !credentials.algorithm) {

return '';
        }

if (hawk.crypto.algorithms.indexOf(credentials.algorithm) === -1) {
            return '';
        }

// Parse URI

uri = hawk.utils.parseUri(uri);

// Calculate signature

var exp = now + options.ttlSec;
        var mac = hawk.crypto.calculateMac('bewit', credentials, {
            ts: exp,
            nonce: '',
            method: 'GET',
            resource: uri.resource, // Maintain trailing '?' and query params
            host: uri.host,
            port: uri.port,
            ext: options.ext
        });

// Construct bewit: id\exp\mac\ext

var bewit = credentials.id + '\\' + exp + '\\' + mac + '\\' + options.ext;
        return hawk.utils.base64urlEncode(bewit);
    },

// Validate server response

/*
        request:    object created via 'new XMLHttpRequest()' after response received or fetch API 'Response'
        artifacts:  object received from header().artifacts
        options: {
            payload:    optional payload received
            required:   specifies if a Server-Authorization header is required. Defaults to 'false'
        }
    */

authenticate: function authenticate(request, credentials, artifacts, options) {

options = options || {};

var getHeader = function getHeader(name) {

// Fetch API or plain headers

if (request.headers) {
                return typeof request.headers.get === 'function' ? request.headers.get(name) : request.headers[name];
            }

// XMLHttpRequest

return request.getResponseHeader ? request.getResponseHeader(name) : request.getHeader(name);
        };

var wwwAuthenticate = getHeader('www-authenticate');
        if (wwwAuthenticate) {

// Parse HTTP WWW-Authenticate header

var wwwAttributes = hawk.utils.parseAuthorizationHeader(wwwAuthenticate, ['ts', 'tsm', 'error']);
            if (!wwwAttributes) {
                return false;
            }

if (wwwAttributes.ts) {
                var tsm = hawk.crypto.calculateTsMac(wwwAttributes.ts, credentials);
                if (tsm !== wwwAttributes.tsm) {
                    return false;
                }

hawk.utils.setNtpSecOffset(wwwAttributes.ts - Math.floor(Date.now() / 1000)); // Keep offset at 1 second precision
            }
        }

// Parse HTTP Server-Authorization header

var serverAuthorization = getHeader('server-authorization');
        if (!serverAuthorization && !options.required) {

return true;
        }

var attributes = hawk.utils.parseAuthorizationHeader(serverAuthorization, ['mac', 'ext', 'hash']);
        if (!attributes) {
            return false;
        }

var modArtifacts = {
            ts: artifacts.ts,
            nonce: artifacts.nonce,
            method: artifacts.method,
            resource: artifacts.resource,
            host: artifacts.host,
            port: artifacts.port,
            hash: attributes.hash,
            ext: attributes.ext,
            app: artifacts.app,
            dlg: artifacts.dlg
        };

var mac = hawk.crypto.calculateMac('response', credentials, modArtifacts);
        if (mac !== attributes.mac) {
            return false;
        }

if (!options.payload && options.payload !== '') {

return true;
        }

if (!attributes.hash) {
            return false;
        }

var calculatedHash = hawk.crypto.calculatePayloadHash(options.payload, credentials.algorithm, getHeader('content-type'));
        return calculatedHash === attributes.hash;
    },

message: function message(host, port, _message, options) {

// Validate inputs

if (!host || typeof host !== 'string' || !port || typeof port !== 'number' || _message === null || _message === undefined || typeof _message !== 'string' || !options || (typeof options === 'undefined' ? 'undefined' : _typeof(options)) !== 'object') {

return null;
        }

// Application time

var timestamp = options.timestamp || hawk.utils.nowSec(options.localtimeOffsetMsec);

// Validate credentials

var credentials = options.credentials;
        if (!credentials || !credentials.id || !credentials.key || !credentials.algorithm) {

// Invalid credential object
            return null;
        }

if (hawk.crypto.algorithms.indexOf(credentials.algorithm) === -1) {
            return null;
        }

// Calculate signature

var artifacts = {
            ts: timestamp,
            nonce: options.nonce || hawk.utils.randomString(6),
            host: host,
            port: port,
            hash: hawk.crypto.calculatePayloadHash(_message, credentials.algorithm)
        };

// Construct authorization

var result = {
            id: credentials.id,
            ts: artifacts.ts,
            nonce: artifacts.nonce,
            hash: artifacts.hash,
            mac: hawk.crypto.calculateMac('message', credentials, artifacts)
        };

return result;
    },

authenticateTimestamp: function authenticateTimestamp(message, credentials, updateClock) {
        // updateClock defaults to true

var tsm = hawk.crypto.calculateTsMac(message.ts, credentials);
        if (tsm !== message.tsm) {
            return false;
        }

if (updateClock !== false) {
            hawk.utils.setNtpSecOffset(message.ts - Math.floor(Date.now() / 1000)); // Keep offset at 1 second precision
        }

return true;
    }
};

hawk.crypto = {

headerVersion: '1',

algorithms: ['sha1', 'sha256'],

calculateMac: function calculateMac(type, credentials, options) {

var normalized = hawk.crypto.generateNormalizedString(type, options);

var hmac = CryptoJS['Hmac' + credentials.algorithm.toUpperCase()](normalized, credentials.key);
        return hmac.toString(CryptoJS.enc.Base64);
    },

generateNormalizedString: function generateNormalizedString(type, options) {

var normalized = 'hawk.' + hawk.crypto.headerVersion + '.' + type + '\n' + options.ts + '\n' + options.nonce + '\n' + (options.method || '').toUpperCase() + '\n' + (options.resource || '') + '\n' + options.host.toLowerCase() + '\n' + options.port + '\n' + (options.hash || '') + '\n';

if (options.ext) {
            normalized += options.ext.replace('\\', '\\\\').replace('\n', '\\n');
        }

normalized += '\n';

if (options.app) {
            normalized += options.app + '\n' + (options.dlg || '') + '\n';
        }

return normalized;
    },

calculatePayloadHash: function calculatePayloadHash(payload, algorithm, contentType) {

var hash = CryptoJS.algo[algorithm.toUpperCase()].create();
        hash.update('hawk.' + hawk.crypto.headerVersion + '.payload\n');
        hash.update(hawk.utils.parseContentType(contentType) + '\n');
        hash.update(payload);
        hash.update('\n');
        return hash.finalize().toString(CryptoJS.enc.Base64);
    },

calculateTsMac: function calculateTsMac(ts, credentials) {

var hash = CryptoJS['Hmac' + credentials.algorithm.toUpperCase()]('hawk.' + hawk.crypto.headerVersion + '.ts\n' + ts + '\n', credentials.key);
        return hash.toString(CryptoJS.enc.Base64);
    }
};

// localStorage compatible interface

hawk.internals.LocalStorage = function () {

this._cache = {};
    this.length = 0;

this.getItem = function (key) {

return this._cache.hasOwnProperty(key) ? String(this._cache[key]) : null;
    };

this.setItem = function (key, value) {

this._cache[key] = String(value);
        this.length = Object.keys(this._cache).length;
    };

this.removeItem = function (key) {

delete this._cache[key];
        this.length = Object.keys(this._cache).length;
    };

this.clear = function () {

this._cache = {};
        this.length = 0;
    };

this.key = function (i) {

return Object.keys(this._cache)[i || 0];
    };
};

hawk.utils = {

storage: new hawk.internals.LocalStorage(),

setStorage: function setStorage(storage) {

var ntpOffset = hawk.utils.storage.getItem('hawk_ntp_offset');
        hawk.utils.storage = storage;
        if (ntpOffset) {
            hawk.utils.setNtpSecOffset(ntpOffset);
        }
    },

setNtpSecOffset: function setNtpSecOffset(offset) {

try {
            hawk.utils.storage.setItem('hawk_ntp_offset', offset);
        } catch (err) {
            console.error('[hawk] could not write to storage.');
            console.error(err);
        }
    },

getNtpSecOffset: function getNtpSecOffset() {

var offset = hawk.utils.storage.getItem('hawk_ntp_offset');
        if (!offset) {
            return 0;
        }

return parseInt(offset, 10);
    },

now: function now(localtimeOffsetMsec) {

return Date.now() + (localtimeOffsetMsec || 0) + hawk.utils.getNtpSecOffset() * 1000;
    },

nowSec: function nowSec(localtimeOffsetMsec) {

return Math.floor(hawk.utils.now(localtimeOffsetMsec) / 1000);
    },

escapeHeaderAttribute: function escapeHeaderAttribute(attribute) {

return attribute.replace(/\\/g, '\\\\').replace(/\"/g, '\\"');
    },

parseContentType: function parseContentType(header) {

if (!header) {
            return '';
        }

return header.split(';')[0].replace(/^\s+|\s+$/g, '').toLowerCase();
    },

parseAuthorizationHeader: function parseAuthorizationHeader(header, keys) {

if (!header) {
            return null;
        }

var headerParts = header.match(/^(\w+)(?:\s+(.*))?$/); // Header: scheme[ something]
        if (!headerParts) {
            return null;
        }

var scheme = headerParts[1];
        if (scheme.toLowerCase() !== 'hawk') {
            return null;
        }

var attributesString = headerParts[2];
        if (!attributesString) {
            return null;
        }

var attributes = {};
        var verify = attributesString.replace(/(\w+)="([^"\\]*)"\s*(?:,\s*|$)/g, function ($0, $1, $2) {

// Check valid attribute names

if (keys.indexOf($1) === -1) {
                return;
            }

// Allowed attribute value characters: !#$%&'()*+,-./:;<=>?@[]^_`{|}~ and space, a-z, A-Z, 0-9

if ($2.match(/^[ \w\!#\$%&'\*\+,\-\.\/\:;<\=>\?@\[\]\^`\{\|\}~]+$/) === null) {
                return;
            }

// Check for duplicates

if (attributes.hasOwnProperty($1)) {
                return;
            }

attributes[$1] = $2;
            return '';
        });

if (verify !== '') {
            return null;
        }

return attributes;
    },

randomString: function randomString(size) {

var randomSource = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
        var len = randomSource.length;

var result = [];
        for (var i = 0; i < size; ++i) {
            result[i] = randomSource[Math.floor(Math.random() * len)];
        }

return result.join('');
    },

//          1                        2             3      4
    uriRegex: /^([^:]+)\:\/\/(?:[^@/]*@)?([^\/:]+)(?:\:(\d+))?([^#]*)(?:#.*)?$/, // scheme://credentials@host:port/resource#fragment
    parseUri: function parseUri(input) {

var parts = input.match(hawk.utils.uriRegex);
        if (!parts) {
            return { host: '', port: '', resource: '' };
        }

var scheme = parts[1].toLowerCase();
        var uri = {
            host: parts[2],
            port: parts[3] || (scheme === 'http' ? '80' : scheme === 'https' ? '443' : ''),
            resource: parts[4]
        };

return uri;
    },

base64urlEncode: function base64urlEncode(value) {

var wordArray = CryptoJS.enc.Utf8.parse(value);
        var encoded = CryptoJS.enc.Base64.stringify(wordArray);
        return encoded.replace(/\+/g, '-').replace(/\//g, '_').replace(/\=/g, '');
    }
};

// $lab:coverage:off$
/* eslint-disable */

hawk.crypto.utils = CryptoJS;

// Export if used as a module

if (typeof module !== 'undefined' && module.exports) {
    module.exports = hawk;
}

/* eslint-enable */
// $lab:coverage:on$