fernet / fernet-rb

Delicious HMAC Digest(if) authentication and AES-128-CBC encryption
MIT License
89 stars 22 forks source link

Verifier#enforce_ttl and Verifier#ttl are settable but ignored #29

Closed msakrejda closed 10 years ago

msakrejda commented 10 years ago

This change should still result in a valid spec, but it fails:

diff --git a/spec/fernet_spec.rb b/spec/fernet_spec.rb
index ce58532..1a9d4f8 100644
--- a/spec/fernet_spec.rb
+++ b/spec/fernet_spec.rb
@@ -67,7 +67,7 @@ describe Fernet do
       config.ttl = 0
     end
     token = Fernet.generate(secret, 'password1')
-    verifier = Fernet.verifier(secret, token)
+    verifier = Fernet.verifier(secret, token, now: Time.now + 99)
     verifier.enforce_ttl = false
     expect(verifier.valid?).to eq(true)
     expect(verifier.message).to eq('password1')

I think it's only passing right now because of the skew element in ttl verification. I believe the only way to actually change TTL is to either pass it in to the verifier constructor, or to set it globally.

See #25.

hgmnz commented 10 years ago

https://github.com/fernet/fernet-rb/commit/f0aa2d06d25199351969d18b08b99a5ecb1a6c11

Thanks for the report!