Per request tokens

gmadarm · 2015-02-08T23:45:57+00:00

Hello! On Fri, Feb 6, 2015 at 9:23 PM, Robert Paprocki wrote: > I've noticed that the code run in the access_by_lua directive seems to run > twice whe...

Per request tokens

gmadarm

I want to implement per request tokens, similer to .NET's ViewState parameters. The code would create a hash for each href link in the response body code and inject a parameter to the href uri with the hash. Initially encrypted-session-nginx-module looked like a good fit, but it looks like there is no way to expire a given variable on the fly, you need to wait until it expires. Besides for tracking the hashes in a database, is there another module that could let me implement this solely in lua?

thanks,
-G

aapo.talvensaari

Have you looked at lua-resty-session:
https://github.com/bungle/lua-resty-session

lordnynex

I think what you're after is more closely aligned with CSRF tokens. Lapis is capable of generating and validating CSRF tokens. If you do not want the overhead of a framework you can use the crypto functions in lua-resty-string to generate a strong token and encrypt a client cookie using a secret key. Subsequent requests can validate this token contained in this cookie and render a new CSRF token.

If the token need to be passed to a backend you can add it as a request header and scrub it on the response. If the token is not needed by a backend, you can use set-misc to access it as an ngx.var in rendered templates.

On Wed, Feb 11, 2015 at 2:22 PM, Aapo Talvensaari <aapo.ta...@gmail.com> wrote:

Have you looked at lua-resty-session:
https://github.com/bungle/lua-resty-session

.