fix: verifyNotificationSignature timestamps are in seconds (#515)

Author: rayeeroded

lib-es5/utils/index.js

@@ -1125,7 +1125,7 @@ function webhook_signature(data, timestamp) {
  * Verifies the authenticity of a notification signature
  *
  * @param {string} body JSON of the request's body
- * @param {number} timestamp Unix timestamp. Can be retrieved from the X-Cld-Timestamp header
+ * @param {number} timestamp Unix timestamp in seconds. Can be retrieved from the X-Cld-Timestamp header
  * @param {string} signature Actual signature. Can be retrieved from the X-Cld-Signature header
  * @param {number} [valid_for=7200] The desired time in seconds for considering the request valid
  *
@@ -1135,7 +1135,7 @@ function verifyNotificationSignature(body, timestamp, signature) {
   var valid_for = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : 7200;
 
   // verify that signature is valid for the given timestamp
-  if (timestamp < Date.now() - valid_for) {
+  if (timestamp < Math.round(Date.now() / 1000) - valid_for) {
     return false;
   }
   var payload_hash = utils.webhook_signature(body, timestamp, {

lib/utils/index.js

@@ -1036,15 +1036,15 @@ function webhook_signature(data, timestamp, options = {}) {
  * Verifies the authenticity of a notification signature
  *
  * @param {string} body JSON of the request's body
- * @param {number} timestamp Unix timestamp. Can be retrieved from the X-Cld-Timestamp header
+ * @param {number} timestamp Unix timestamp in seconds. Can be retrieved from the X-Cld-Timestamp header
  * @param {string} signature Actual signature. Can be retrieved from the X-Cld-Signature header
  * @param {number} [valid_for=7200] The desired time in seconds for considering the request valid
  *
  * @return {boolean}
  */
 function verifyNotificationSignature(body, timestamp, signature, valid_for = 7200) {
   // verify that signature is valid for the given timestamp
-  if (timestamp < Date.now() - valid_for) {
+  if (timestamp < Math.round(Date.now() / 1000) - valid_for) {
     return false;
   }
   const payload_hash = utils.webhook_signature(body, timestamp, {

test/utils/utils_spec.js

@@ -1459,8 +1459,8 @@ describe("utils", function () {
         'width': 100,
         'height': 100
       };
-      valid_response_timestamp = Date.now() - 5000;
-      invalid_response_timestamp = Date.now() - 50 * 1000;
+      valid_response_timestamp = (Date.now()/1000) - 5000;
+      invalid_response_timestamp = (Date.now()/1000) - 10000;
       response_json = JSON.stringify(expected_parameters);
       unexpected_response_json = JSON.stringify(unexpected_parameters);
     });