@@ -6,8 +6,10 @@ import (
66 "crypto/hmac"
77 "crypto/rand"
88 "crypto/sha1"
9+ "crypto/sha256"
910 "encoding/base64"
1011 "fmt"
12+ "hash"
1113 "io"
1214 "net/http"
1315 "strconv"
@@ -25,8 +27,7 @@ func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value
2527 if len(parts) != 3 {
2628 return
2729 }
28− sig := cookieSignature(seed, cookie.Name, parts[0], parts[1])
29− if checkHmac(parts[2], sig) {
30+ if checkSignature(parts[2], seed, cookie.Name, parts[0], parts[1]) {
3031 ts, err := strconv.Atoi(parts[1])
3132 if err != nil {
3233 return
@@ -53,13 +54,13 @@ func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value
5354func SignedValue(seed string, key string, value string, now time.Time) string {
5455 encodedValue := base64.URLEncoding.EncodeToString([]byte(value))
5556 timeStr := fmt.Sprintf("%d", now.Unix())
56− sig := cookieSignature(seed, key, encodedValue, timeStr)
57+ sig := cookieSignature(sha256.New, seed, key, encodedValue, timeStr)
5758 cookieVal := fmt.Sprintf("%s|%s|%s", encodedValue, timeStr, sig)
5859 return cookieVal
5960}
6061
61−func cookieSignature(args ...string) string {
62− h := hmac.New(sha1.New, []byte(args[0]))
62+func cookieSignature(signer func() hash.Hash, args ...string) string {
63+ h := hmac.New(signer, []byte(args[0]))
6364 for _, arg := range args[1:] {
6465 h.Write([]byte(arg))
6566 }
@@ -68,6 +69,17 @@ func cookieSignature(args ...string) string {
6869 return base64.URLEncoding.EncodeToString(b)
6970}
7071
72+func checkSignature(signature string, args ...string) bool {
73+ checkSig := cookieSignature(sha256.New, args...)
74+ if checkHmac(signature, checkSig) {
75+ return true
76+ }
77+
78+ // TODO: After appropriate rollout window, remove support for SHA1
79+ legacySig := cookieSignature(sha1.New, args...)
80+ return checkHmac(signature, legacySig)
81+}
82+
7183func checkHmac(input, expected string) bool {
7284 inputMAC, err1 := base64.URLEncoding.DecodeString(input)
7385 if err1 == nil {