951dd8d26b
Some checks failed
ci / go (push) Has been cancelled
ci / admin-ui (push) Has been cancelled
ci / runtime-sdk (push) Has been cancelled
ci / helm (push) Has been cancelled
ci / openapi (push) Has been cancelled
ci / container (push) Has been cancelled
ci / release-config (push) Has been cancelled
ci / shared styling (push) Has been cancelled
ci / security (push) Has been cancelled
ci / all green (push) Has been cancelled
20 lines
561 B
Go
20 lines
561 B
Go
package auth
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
)
|
|
|
|
// sha256HMAC computes an HMAC-SHA256 tag.
|
|
//
|
|
// It is a thin wrapper so that the session store and the OIDC state store
|
|
// cannot accidentally diverge on how they sign. The stdlib hmac package already
|
|
// performs a constant-time internal comparison; the constant-time requirement
|
|
// in this codebase is about how *we* compare the resulting tags.
|
|
func sha256HMAC(key, body []byte) [32]byte {
|
|
mac := hmac.New(sha256.New, key)
|
|
mac.Write(body)
|
|
var out [32]byte
|
|
copy(out[:], mac.Sum(nil))
|
|
return out
|
|
}
|