Skip to content
Snippets Groups Projects
Commit 496c4303 authored by Torben Hansen's avatar Torben Hansen Committed by Oliver Hader
Browse files

[FEATURE] Introduce class to generate/validate HMAC hashes


The `GeneralUtility::hmac()` function is used in several places
to create HMAC hashes for a given string and optional additional
secret.

Extbase has the class `HashService`, which also provides the
ability to create a HMAC for a given string, but without the
possibility to add an additional secret. The missing possibility
to use an additional secret is suboptimal in terms of security,
since generated HMAC hashes will be equal for the same input
in different contexts.

This change introduces a new class, which combines the
functionality of `GeneralUtility::hmac()` and Extbase
`HashService` but with the requirement, that an additional
secret is always mandatory.

The class will be used in follow up patches, where
`GeneralUtility::hmac()` and Extbase `HashService` will be
deprecated.

Resolves: #102761
Releases: main
Signed-off-by: default avatarTorben Hansen <derhansen@gmail.com>
Change-Id: Ibf0be09f4dffe076ddd0d3a31323ccd05693f7c1
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/80394


Tested-by: default avatarcore-ci <typo3@b13.com>
Reviewed-by: default avatarAndreas Kienast <a.fernandez@scripting-base.de>
Tested-by: default avatarOliver Hader <oliver.hader@typo3.org>
Tested-by: default avatarAndreas Kienast <a.fernandez@scripting-base.de>
Reviewed-by: default avatarOliver Hader <oliver.hader@typo3.org>
Reviewed-by: default avatarOliver Klee <typo3-coding@oliverklee.de>
Tested-by: default avatarOliver Klee <typo3-coding@oliverklee.de>
parent 889e3de6
Branches
Tags
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment