liyu001989/signature

getSignString called two times on verify

Closed this issue · 1 comments

adifaidz commented

When Signature::verify is called the function getSignString() is called and sent to sign()

public function verify($signature, $data)
    {
        $signString = $this->getSignString($data);

        // Timing attack safe string comparison
        return hash_equals($signature, $this->sign($signString));
    }

In sign(), getSignString() is called again.

    public function sign($data)
    {
        $signString = $this->getSignString($data);

        return hash_hmac($this->getAlgo(), $signString, $this->getKey());
    }