16 Membuat Middleware Hmac Authentication Pada Golang

go get github.com/julienschmidt/httprouter

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io/ioutil"
	"net/http"
	"strings"

	"github.com/julienschmidt/httprouter"
)

// Secret key untuk verifikasi HMAC
var secretKey = []byte("your-secret-key")

// Middleware HMAC
func HMACMiddleware(next httprouter.Handle) httprouter.Handle {
	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
		// Ambil tanda tangan dari header "X-Signature"
		signature := r.Header.Get("X-Signature")
		if signature == "" {
			http.Error(w, "Missing signature", http.StatusUnauthorized)
			return
		}

		// Ambil body request untuk membuat tanda tangan
		body, err := ioutil.ReadAll(r.Body)
		if err != nil {
			http.Error(w, "Unable to read body", http.StatusInternalServerError)
			return
		}

		// Buat HMAC dari body menggunakan kunci rahasia
		mac := hmac.New(sha256.New, secretKey)
		mac.Write(body)
		expectedSignature := hex.EncodeToString(mac.Sum(nil))

		// Verifikasi apakah tanda tangan sesuai
		if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
			http.Error(w, "Invalid signature", http.StatusUnauthorized)
			return
		}

		// Lanjutkan ke handler berikutnya
		next(w, r, ps)
	}
}

// Handler untuk halaman private yang membutuhkan otentikasi hmac
func ProtectedHMACHandler(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	w.Write([]byte("Welcome to the session private page"))
}

func main() {
	router := httprouter.New()

	// sample for initiate hmac
	mac := hmac.New(sha256.New, middleware.SecretKey)
	mac.Write([]byte(`Hello World`))
	validSignature := hex.EncodeToString(mac.Sum(nil))
	fmt.Println("generate hmac sample: " + validSignature)

	// Menggunakan middleware HMAC untuk endpoint ini
	router.GET("/protected-hmac", middleware.HMAC(ProtectedHMACHandler))

	// Menjalankan server
	http.ListenAndServe(":8080", router)
}

package main

import (
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/julienschmidt/httprouter"
	"github.com/stretchr/testify/assert"
)

func makeRequest(signature string, body string) *http.Request {
	req := httptest.NewRequest(http.MethodGet, "/hello", strings.NewReader(body))
	req.Header.Set("X-Signature", signature)
	return req
}

func generateSignature(body string) string {
	mac := hmac.New(sha256.New, SecretKey)
	mac.Write([]byte(body))
	return hex.EncodeToString(mac.Sum(nil))
}

func TestHMACMiddleware(t *testing.T) {
	router := httprouter.New()
	router.GET("/hello", HMAC(mockHMACHandler))

	type args struct {
		signature string
		body      string
	}
	tests := []struct {
		name             string
		args             args
		wantStatusCode   int
		wantBodyContains string
	}{
		{
			name: "valid HMAC signature",
			args: args{
				signature: generateSignature("Hello World"),
				body:      "Hello World",
			},
			wantStatusCode:   http.StatusOK,
			wantBodyContains: "Welcome to the session private page",
		},
		{
			name: "invalid HMAC signature",
			args: args{
				signature: "invalid-signature",
				body:      "Hello World",
			},
			wantStatusCode:   http.StatusUnauthorized,
			wantBodyContains: "Invalid signature",
		},
		{
			name: "signature is empty",
			args: args{
				signature: "",
				body:      "Hello World",
			},
			wantStatusCode:   http.StatusUnauthorized,
			wantBodyContains: "Missing signature",
		},
		{
			name: "body was changed (error mismatch signature)",
			args: args{
				signature: generateSignature("Original Body"),
				body:      "Tampered Body",
			},
			wantStatusCode:   http.StatusUnauthorized,
			wantBodyContains: "Invalid signature",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			req := makeRequest(tt.args.signature, tt.args.body)
			rr := httptest.NewRecorder()

			router.ServeHTTP(rr, req)

			if rr.Code != tt.wantStatusCode {
				t.Errorf("handler returned wrong status code: got %v, want %v", rr.Code, tt.wantStatusCode)
			}
			if !strings.Contains(rr.Body.String(), tt.wantBodyContains) {
				t.Errorf("handler returned unexpected body: got %v, want to contain %v", rr.Body.String(), tt.wantBodyContains)
			}
		})
	}
}

func mockHMACHandler(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
	w.Write([]byte("Welcome to the session private page"))
}

go test -v