vendor/codeages/web-lib/src/Auth/SignatureTokenAlgo.php

这里只显示每个文件的开头 60 行。登录后可以解锁完整代码。

微信扫码关注公众号，代码整理好后第一时间通知你。

<?php

namespace Codeages\Weblib\Auth;

use Codeages\Weblib\Error\ErrorCode;

class SignatureTokenAlgo implements TokenAlgo
{
    public function parse($tokenValue)
    {
        $tokenValue = explode(':', $tokenValue);
        if (count($tokenValue) !== 4 || empty($tokenValue[0]) || empty($tokenValue[1]) || empty($tokenValue[2]) || empty($tokenValue[3])) {
            throw new AuthException('Auth token format is invalid.', ErrorCode::INVALID_CREDENTIAL);
        }

        return new Token($tokenValue[0], '', $tokenValue[1], $tokenValue[2], $tokenValue[3]);
    }

    public function check(Token $token, AccessKey $key, $signingText = '')
    {
        if ($token->isReplay()) {
            throw new AuthException("Auth token is replay.", ErrorCode::INVALID_CREDENTIAL);
        }

        if ($token->isExpired()) {
            throw new AuthException("Auth token is expired.", ErrorCode::EXPIRED_CREDENTIAL);
        }

        $signingText = "{$token->once}\n{$token->deadline}\n{$signingText}";

        $signature = $this->signature($signingText, $key->secret);

        if (empty($token->signature) || $token->signature != $signature) {
            throw new AuthException("Signature is invalid.", ErrorCode::INVALID_CREDENTIAL);
        }

        return true;
    }

    public function signature($signingText, $secretKey)
    {
        $signature = hash_hmac('sha1', $signingText, $secretKey, true);
        return  str_replace(array('+', '/'), array('-', '_'), base64_encode($signature));
    }
}