algermissen / hawkc Goto Github PK
View Code? Open in Web Editor NEWA C implementation of hawk
License: MIT License
A C implementation of hawk
License: MIT License
Currently these functions take an int. This leads to undesired casts from size_t to int in some places.
It is not yet clear to me, how to treat escaped chars (e.g. ") in the ext-parameter. The original Hawk implementation seems to remove the escapes before calculating the signature.
However, removing them would require a string copy and thus allocation - this is something I want to avoid as much as possible in the C version in Hawk.
Matching must be case insensitive as per http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-23#section-2.1
It would be more consistent to rename context's header_in to authorization_header_in and the same for header_out.
Minor issue - but keeps bugging me.
Creating a header value currently requires to call length calculation function first but it is not enforced. Not calling the function will lead to failure.
Enforce correct call sequence through internal state checking.
For Oz-like use cases, it would be nice to have a header parameter that told the client what kind of error lead to the 401. One case would be expired ticket.
Needs investigation, because a
4xx Credentials expired would also be a good fit.
hawkc_validate_hmac in common.c contains a 1k buffer for the base string that is not yet neither dynamic nor size-checked.
Suggested fix: use static default buffer of reasonable size, check size and use dynamic allocation if necessary.
Add a size check to prevent from writing past the buffer end.
Not a problem now as I use buffers larger than what a UNIX time can be - but to be save here would be nicer.
Hawk benefits from client and server setting their clock via SNTP.
Hawk includes the ability to add a hash of the message body to the Authorization header. This has not yet been implemented in Hawkc.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.