twotalesanimation
28 lines
841 B
TypeScript
28 lines
841 B
TypeScript
// lib/transcoder-auth.ts
|
|
// Timing-safe Bearer token verification for transcoder API endpoints.
|
|
import { createHash, timingSafeEqual } from "crypto";
|
|
|
|
/**
|
|
* Verifies the incoming request carries the correct TRANSCODER_SECRET
|
|
* via an "Authorization: Bearer <token>" header.
|
|
*
|
|
* Uses HMAC-SHA256 hashes and timingSafeEqual to prevent timing attacks.
|
|
*/
|
|
export function verifyTranscoderToken(request: Request): boolean {
|
|
const secret = process.env.TRANSCODER_SECRET;
|
|
if (!secret) return false;
|
|
|
|
const auth = request.headers.get("authorization") ?? "";
|
|
if (!auth.startsWith("Bearer ")) return false;
|
|
|
|
const token = auth.slice(7);
|
|
|
|
try {
|
|
const a = createHash("sha256").update(token).digest();
|
|
const b = createHash("sha256").update(secret).digest();
|
|
return timingSafeEqual(a, b);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|