/sign fails to authenticate

[mikehale]

I just deployed l2met from 27b6331 and it is returning 'Authentication failed.' when I attempt to sign credentials. I'm pretty sure I'm using the same secret on the process and the request, thinking that perhaps this was a code regression?

[ryandotsmith]

Can you provide the command you are using to sign?

[mikehale]

$ curl 'http://localhost:5000/sign' --data "lu:t" -u 'BecstsYSkJY33Us91kgl6qPubHowWXcqaBxqhu7Nu6_=:'
Authentication failed.

It looks like this is an encoding error possibly in kr/fernet. If you replace the '_' with some alpha numeric character (for both the l2met process and the curl command) everything just works.

So far I can't get auth to work with '+' or '_' in the SECRETS env.

[ryandotsmith]

@mikehale so is it a problem with the command used to generate SECRETS?

[mikehale]

I'm not sure. Ruby properly url encodes/decodes strings that l2met/fernet has trouble with. I'm not certain which is out of spec.

[mikehale]

This shows that in ruby decoding an encoded string returns the original string:

$ dd if=/dev/urandom bs=32 count=1 2>/dev/null | openssl base64|ruby -ruri -e 's=STDIN.read.chomp; puts [s, URI.decode(URI.encode(s))]'
sRd/0ehjza+7zMRjmytZG4yNVUJ7+NhyXWZY+dx/Rg4=
sRd/0ehjza+7zMRjmytZG4yNVUJ7+NhyXWZY+dx/Rg4=

[ryandotsmith]

I suspect this problem may be with the way that l2met is decoding the authorization header. You can see the call to decode here:

https://github.com/ryandotsmith/l2met/blob/master/auth/auth.go#L53

Notice I am using the base64 pkg's StdEncoding variable. I noticed that there is a URLEncoding variable that will handle the URL safe versions of base64. I am going to research and test the different implementation to see if the URLENcoding provides a more robust implementation of header parsing.

[ryandotsmith]

Using URLEncoding did not solve the problem. After some more digging, I may have uncovered a bug in kr/fernet. Here is my bug report. fernet/fernet-go#5

[jamischarles]

Was seeing this as well using the ./scripts/setup script.

It failed 5 times in a row for me (I manually wiped the repo and heroku app each time).

I increased the sleep in the script to 5, then it worked (not sure if there's a correlation).