Chris Chen
85bf329d93
Implements LineSignature.IsValid() using HMAC-SHA256 + FixedTimeEquals to prevent timing attacks; includes xUnit tests for valid, tampered, and null/empty header cases. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
721 B
C#
21 lines
721 B
C#
using System.Security.Cryptography;
|
|
using System.Text;
|
|
|
|
namespace ROLAC.API.Services.Notifications;
|
|
|
|
/// <summary>Verifies the X-Line-Signature header (HMAC-SHA256 of the raw body, base64).</summary>
|
|
public static class LineSignature
|
|
{
|
|
public static bool IsValid(string channelSecret, byte[] rawBody, string? signatureHeader)
|
|
{
|
|
if (string.IsNullOrEmpty(signatureHeader)) return false;
|
|
|
|
using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(channelSecret));
|
|
var expected = Convert.ToBase64String(hmac.ComputeHash(rawBody));
|
|
|
|
return CryptographicOperations.FixedTimeEquals(
|
|
Encoding.UTF8.GetBytes(expected),
|
|
Encoding.UTF8.GetBytes(signatureHeader));
|
|
}
|
|
}
|