Token.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Session;
 
use Stringable;
use Wikimedia\Timestamp\ConvertibleTimestamp;
use Wikimedia\Timestamp\TimestampFormat as TS;
 
class Token implements Stringable {
    public const SUFFIX = '+\\';
 
    private $secret;
 
    private $salt;
 
    private $new;
 
    public function __construct( $secret, $salt, $new = false ) {
        $this->secret = $secret;
        $this->salt = $salt;
        $this->new = $new;
    }
 
    public static function getTimestamp( $token ) {
        $suffixLen = strlen( self::SUFFIX );
        $len = strlen( $token );
        if ( $len <= 32 + $suffixLen ||
            substr( $token, -$suffixLen ) !== self::SUFFIX ||
            strspn( $token, '0123456789abcdef' ) + $suffixLen !== $len
        ) {
            return null;
        }
 
        return hexdec( substr( $token, 32, -$suffixLen ) );
    }
 
    protected function toStringAtTimestamp( $timestamp ) {
        return hash_hmac( 'md5', $timestamp . $this->salt, $this->secret, false ) .
            dechex( $timestamp ) .
            self::SUFFIX;
    }
 
    public function toString() {
        return $this->toStringAtTimestamp( (int)ConvertibleTimestamp::now( TS::UNIX ) );
    }
 
    public function __toString() {
        return $this->toString();
    }
 
    public function match( $userToken, $maxAge = null ) {
        if ( !$userToken ) {
            return false;
        }
        $timestamp = self::getTimestamp( $userToken );
        if ( $timestamp === null ) {
            return false;
        }
        if ( $maxAge !== null && $timestamp < (int)ConvertibleTimestamp::now( TS::UNIX ) - $maxAge ) {
            // Expired token
            return false;
        }
 
        $sessionToken = $this->toStringAtTimestamp( $timestamp );
        return hash_equals( $sessionToken, $userToken );
    }
 
    public function wasNew() {
        return $this->new;
    }
 
}