Julien Roncaglia vbfox

HMAC over Basic Auth

This is a pattern I use fairly frequently for administrative APIs. It's a sort of OAuth lite for non-public APIs that produces good quality tokens. Once you build it a few times, it's not any harder than using arbitrary basic auth in your APIs.

The client and the app share a secret, which is never transmitted across the wire. The client uses this secret to create an HMAC digest of a payload consisting of the current time and a random nonce value. The nonce is provided as the Basic Authorization user, and the resulting HMAC digest is provided as the Basic Authorization password.

A similar process is followed on the server side. The server uses the supplied nonce, its own time, and its own copy of the shared secret. It may want to check against several tokens across a small window of times to account for clock drift.

Using HMAC means the secret is never transmitted across the wire. Theoretically these are safe across plaintext connections, but you're using TLS anyway, right?
The i

$/
  artifacts/
  build/
  docs/
  lib/
  packages/
  samples/
  src/
 tests/

	using System;

	namespace Virtlink
	{
	/// <summary>
	/// Executes a particular piece of code based on the type of the argument.
	/// </summary>
	/// <example>
	/// Usage example:
	/// <code>

	public static class AwaitExtensions
	{
	/// <summary>
	/// Provides await functionality for ordinary <see cref="WaitHandle"/>s.
	/// </summary>
	/// <param name="handle">The handle to wait on.</param>
	/// <returns>The awaiter.</returns>
	public static TaskAwaiter GetAwaiter(this WaitHandle handle)
	{
	Contract.Requires<ArgumentNullException>(handle != null);