OAuthSignatureMethod.php

Go to the documentation of this file.

<?php

namespace IMSGlobal\LTI\OAuth;

abstract class OAuthSignatureMethod {
    abstract public function get_name();

    abstract public function build_signature($request, $consumer, $token);

    public function check_signature($request, $consumer, $token, $signature) {

        $built = $this->build_signature($request, $consumer, $token);

        // Check for zero length, although unlikely here
        if (strlen($built) == 0 || strlen($signature) == 0) {
            return false;
        }

        if (strlen($built) != strlen($signature)) {
            return false;
        }

        // Avoid a timing leak with a (hopefully) time insensitive compare
        $result = 0;
        for ($i = 0; $i < strlen($signature); $i++) {
            $result |= ord($built{$i}) ^ ord($signature{$i});
        }

        return $result == 0;

    }

}