JTigerNova.jtiger.security 1.0.0

jtiger.security

.NET Standard 2.0 library of shared security primitives for JTiger Nova.

Currently: Ed25519 signing and validation of share-protected media URLs, so the signer and the media-server validator run one implementation instead of two that can drift apart.

Renamed from Business.Lib.Service.JTigerNova.Security. The namespace is now jtiger.security.

Signed media URLs

A signed URL carries two query params:

Only the path is signed - the canonical string is "<urlPath>|<exp>" - so unrelated query params (cache busters, tracking, resize hints) never invalidate a link.

API

public static class SignedMediaUrl
{
    public const string ParamExp = "exp";
    public const string ParamSig = "sig";

    public static string Canonical(string urlPath, long expUnixSeconds);
    public static string Sign(string urlPath, long expUnixSeconds, string privateKeyBase64Url);

    public static bool Validate(string urlPath, string exp, string sig, long nowUnixSeconds,
        int skewSeconds, IEnumerable<string> publicKeysBase64Url);

    public static string GeneratePrivateKey();
    public static string PublicKeyFromPrivate(string privateKeyBase64Url);
    public static string KeyId(string publicKeyBase64Url);

    public static string Base64UrlEncode(byte[] bytes);
    public static byte[] Base64UrlDecode(string value);
}

Signing

var exp = DateTimeOffset.UtcNow.AddMinutes(15).ToUnixTimeSeconds();
var sig = SignedMediaUrl.Sign("/media/protected/abc.jpg", exp, privateKey);

var url = $"/media/protected/abc.jpg?{SignedMediaUrl.ParamExp}={exp}&{SignedMediaUrl.ParamSig}={sig}";

Validating

var ok = SignedMediaUrl.Validate(
    urlPath:             request.Url.AbsolutePath,
    exp:                 request.QueryString[SignedMediaUrl.ParamExp],
    sig:                 request.QueryString[SignedMediaUrl.ParamSig],
    nowUnixSeconds:      DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
    skewSeconds:         60,
    publicKeysBase64Url: activePublicKeys);

Validate takes a collection of public keys so a rotation can accept the outgoing and incoming key at once. skewSeconds tolerates clock drift between the signer and the validator.

Any malformed input - unparseable exp, non-base64url sig, wrong-length signature or key - returns false rather than throwing. Sign, PublicKeyFromPrivate, and KeyId do throw on a malformed key, since that is a configuration error rather than untrusted request data.

Keys

var priv = SignedMediaUrl.GeneratePrivateKey();      // base64url 32-byte seed - keep secret
var pub  = SignedMediaUrl.PublicKeyFromPrivate(priv); // base64url 32-byte public key - publishable
var id   = SignedMediaUrl.KeyId(pub);                 // base64url SHA-256 thumbprint

Dependencies

• BouncyCastle.Cryptography

License

MIT License - Copyright 2026 JTiger Nova