Implements the two signature schemes Pusher/Reverb use:
- Channel auth (private-/presence- subscriptions), signed by Laravel's
/broadcasting/authroute and verified here when a client subscribes. - REST API auth, used by Laravel's server-side
pusherbroadcaster when it POSTs an event to/apps/{app_id}/events.
Every function takes an instance name first, since different embedded
instances can have different app credentials.
Summary
Functions
Rejects requests whose auth_timestamp is more than 10 minutes off, so a captured request can't be replayed later.
HMAC-SHA256 of string_to_sign with secret, as lowercase hex. Every Pusher signature uses this.
The REST signature only covers the query string, which includes
body_md5. This checks that body_md5 really is the MD5 of the request
body — without it the signature would not protect the payload.
Verifies the auth string a client sends when subscribing to a private/presence channel.
Verifies a REST API request's auth_signature query param.
Functions
Rejects requests whose auth_timestamp is more than 10 minutes off, so a captured request can't be replayed later.
HMAC-SHA256 of string_to_sign with secret, as lowercase hex. Every Pusher signature uses this.
The REST signature only covers the query string, which includes
body_md5. This checks that body_md5 really is the MD5 of the request
body — without it the signature would not protect the payload.
Verifies the auth string a client sends when subscribing to a private/presence channel.
Verifies a REST API request's auth_signature query param.
string_to_sign = "METHOD\nPATH\nsorted_query_params_excluding_auth_signature"