ValidateSignature class

Answers 403 Forbidden when the url of the request has no valid signature, or its expires time is past. Make such urls with Route.signedUrl.

Route.get('unsubscribe/{user}', <dynamic>[
  const ValidateSignature(),
  userController.unsubscribe,
]).name('unsubscribe');

String url = Route.signedUrl(
  'unsubscribe',
  params: <String, Object>{'user': 5},
  expires: Duration(days: 7),
);

Use ValidateSignature(absolute: false) for urls made with absolute: false. An absolute url checks the scheme and host too, so the Host of the request must be the host of APP_URL (or of the baseUrl it was made with). Behind a proxy, keep the Host header and add the proxy to AppConfig.trustedProxies for the scheme.

Implemented types

• IDoxMiddleware

Constructors

ValidateSignature({bool absolute = true})

const

Properties

absolute → bool

the url was made with absolute: true (the default)

final

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

handle(IDoxRequest req) → IDoxRequest

override

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

hasValidSignature(DoxRequest req, {bool absolute = true}) → bool

True when req has a valid signature that has not expired.

sign(String url) → String

The signature of url (hex HMAC-SHA256 with the signed url key).