com.nimbusds.jose.crypto.MACVerifier Maven / Gradle / Ivy
Show all versions of nimbus-jose-jwt Show documentation
package com.nimbusds.jose.crypto;
import java.util.HashSet;
import java.util.Set;
import net.jcip.annotations.ThreadSafe;
import com.nimbusds.jose.*;
import com.nimbusds.jose.util.Base64URL;
/**
* Message Authentication Code (MAC) verifier of
* {@link com.nimbusds.jose.JWSObject JWS objects}. This class is thread-safe.
*
* Supports the following JSON Web Algorithms (JWAs):
*
*
* - {@link com.nimbusds.jose.JWSAlgorithm#HS256}
*
- {@link com.nimbusds.jose.JWSAlgorithm#HS384}
*
- {@link com.nimbusds.jose.JWSAlgorithm#HS512}
*
*
* Accepts all {@link com.nimbusds.jose.JWSHeader#getRegisteredParameterNames
* registered JWS header parameters}. Use {@link #setAcceptedAlgorithms} to
* restrict the acceptable JWS algorithms.
*
* @author Vladimir Dzhuvinov
* @version $version$ (2014-09-01)
*/
@ThreadSafe
public class MACVerifier extends MACProvider implements JWSVerifier {
/**
* The accepted JWS algorithms.
*/
private Set acceptedAlgs =
new HashSet<>(supportedAlgorithms());
/**
* The critical header parameter checker.
*/
private final CriticalHeaderParameterChecker critParamChecker =
new CriticalHeaderParameterChecker();
/**
* Creates a new Message Authentication (MAC) verifier.
*
* @param sharedSecret The shared secret. Must not be {@code null}.
*/
public MACVerifier(final byte[] sharedSecret) {
super(sharedSecret);
}
/**
* Creates a new Message Authentication (MAC) verifier.
*
* @param sharedSecretString The shared secret as a UTF-8 encoded
* string. Must not be {@code null}.
*/
public MACVerifier(final String sharedSecretString) {
super(sharedSecretString);
}
@Override
public Set getAcceptedAlgorithms() {
return acceptedAlgs;
}
@Override
public void setAcceptedAlgorithms(final Set acceptedAlgs) {
if (acceptedAlgs == null) {
throw new IllegalArgumentException("The accepted JWS algorithms must not be null");
}
if (! supportedAlgorithms().containsAll(acceptedAlgs)) {
throw new IllegalArgumentException("Unsupported JWS algorithm(s)");
}
this.acceptedAlgs = acceptedAlgs;
}
@Override
public Set getIgnoredCriticalHeaderParameters() {
return critParamChecker.getIgnoredCriticalHeaders();
}
@Override
public void setIgnoredCriticalHeaderParameters(final Set headers) {
critParamChecker.setIgnoredCriticalHeaders(headers);
}
@Override
public boolean verify(final JWSHeader header,
final byte[] signedContent,
final Base64URL signature)
throws JOSEException {
String jcaAlg = getJCAAlgorithmName(header.getAlgorithm());
if (! critParamChecker.headerPasses(header)) {
return false;
}
byte[] expectedHMAC = HMAC.compute(jcaAlg, getSharedSecret(), signedContent, provider);
return ConstantTimeUtils.areEqual(expectedHMAC, signature.decode());
}
}