@@ -18,7 +18,7 @@ func validateCookie(cookie *http.Cookie, seed string) (string, bool) {
18 return "", false
18 return "", false
20 sig := cookieSignature(seed, cookie.Name, parts[0], parts[1])
20 sig := cookieSignature(seed, cookie.Name, parts[0], parts[1])
21− if parts[2] == sig {
21+ if checkHmac(parts[2], sig) {
22 ts, err := strconv.Atoi(parts[1])
22 ts, err := strconv.Atoi(parts[1])
23 if err == nil && int64(ts) > time.Now().Add(time.Duration(24)*7*time.Hour*-1).Unix() {
23 if err == nil && int64(ts) > time.Now().Add(time.Duration(24)*7*time.Hour*-1).Unix() {
24 // it's a valid cookie. now get the contents
24 // it's a valid cookie. now get the contents
@@ -48,3 +48,14 @@ func cookieSignature(args ...string) string {
48 b = h.Sum(b)
48 b = h.Sum(b)
49 return base64.URLEncoding.EncodeToString(b)
49 return base64.URLEncoding.EncodeToString(b)
52+func checkHmac(input, expected string) bool {
53+ inputMAC, err1 := base64.URLEncoding.DecodeString(input)
55+ expectedMAC, err2 := base64.URLEncoding.DecodeString(expected)
57+ return hmac.Equal(inputMAC, expectedMAC)