add optional server-side HMAC TTL to prevent replay attacks

lib/ey-hmac.rb

@@ -12,6 +12,7 @@ module Hmac
     MissingSecret        = Class.new(Error)
     MissingAuthorization = Class.new(Error)
     SignatureMismatch    = Class.new(Error)
+    ExpiredHmac          = Class.new(Error)
 
     autoload :Adapter, "ey-hmac/adapter"
     autoload :Faraday, "ey-hmac/faraday"

lib/ey-hmac/adapter.rb

@@ -10,13 +10,15 @@ class Ey::Hmac::Adapter
 
   # @param [Object] request signer-specific request implementation
   # @option options [Integer] :version signature version
+  # @option options [Integer] :ttl (nil) duration during which HMAC is valid after signed date
   # @option options [String] :authorization_header ('Authorization') Authorization header key.
   # @option options [String] :server ('EyHmac') service name prefixed to {#authorization}. set to {#service}
   # @option options [Symbol] :sign_with (:sha_256) outgoing signature digest algorithm. See {OpenSSL::Digest#new}
   # @option options [Array] :accepted_digests ([:sha_256]) accepted incoming signature digest algorithm. See {OpenSSL::Digest#new}
   def initialize(request, options={})
     @request, @options = request, options
 
+    @ttl                  = options[:ttl]
     @authorization_header = options[:authorization_header] || 'Authorization'
     @service              = options[:service] || 'EyHmac'
     @sign_with            = options[:sign_with] || :sha256
@@ -121,6 +123,14 @@ def authenticated!(&block)
       raise(Ey::Hmac::MissingSecret, "Failed to find secret matching #{key_id.inspect}")
     end
 
+    unless @ttl.nil?
+      expiry = Time.parse(date).to_i + @ttl
+      current_time = Time.now.to_i
+      unless expiry > current_time
+        raise(Ey::Hmac::ExpiredHmac, "Signature has expired passed #{expiry}. Current time is #{current_time}")
+      end
+    end
+
     calculated_signatures = self.accept_digests.map { |ad| signature(key_secret, ad) }
 
     unless calculated_signatures.any? { |cs| secure_compare(signature_value, cs) }

spec/shared/authenticated.rb

@@ -51,5 +51,25 @@
         end).to be_falsey
       }.to raise_exception(Ey::Hmac::MissingAuthorization)
     end
+
+    context "when the server specifies an HMAC TTL" do
+      it "should not authenticate expired hmac" do
+        Ey::Hmac.sign!(request, key_id, key_secret, adapter: adapter)
+        expect {
+          Ey::Hmac.authenticate!(request, adapter: adapter, ttl: 0) do |auth_id|
+            (auth_id == key_id) && key_secret
+          end
+        }.to raise_exception(Ey::Hmac::ExpiredHmac)
+      end
+
+      it "should authenticate non-expired hmac" do
+        Ey::Hmac.sign!(request, key_id, key_secret, adapter: adapter)
+        expect {
+          Ey::Hmac.authenticate!(request, adapter: adapter, ttl: 100) do |auth_id|
+            (auth_id == key_id) && key_secret
+          end
+        }.to_not raise_exception
+      end
+    end
   end
 end