project Websites / videos.bentasker.co.uk avatar

Websites / videos.bentasker.co.uk: eb684167

VID-12 Create token validation script.

VID-12 Create token validation script.

Reads token and expiry in from the query string and checks if they're valid for the time of the request, and the path that's being requested.

Functionality currently works. However, if enforced, it would currently break playback:

The next step is to address that

Commit eb684167.

Authored 2019-04-18T16:08:38.000+01:00 by B Tasker in project Websites / videos.bentasker.co.uk

+66 lines -0 lines

Changes

diff --git a/resources/tokenisation/minter/token_validate.lua b/resources/tokenisation/minter/token_validate.lua
--- a/resources/tokenisation/minter/token_validate.lua
+++ b/resources/tokenisation/minter/token_validate.lua
# @@ -0,0 +1,66 @@
# +-- VID-11 Token validator
# +--
# +-- Validate a token against the requested path (and the client making the request) and deny access if validation fails.
# +
# +
# +
# +local table = table
# +local require = require
# +local string = string
# +local os = os
# +local sha256 = require "lib.sha256"
# +
# +local function mint_token(path,expires,ip,secret)
# + local mint = {path,expires,ip}
# + local mintstr = table.concat(mint,':')
# + -- print mintstr
# + return sha256.hmac_sha256(secret,mintstr)
# +end
# +
# +
# +local function denyaccess(reason)
# + ngx.status = 403
# + ngx.header['X-Fail-Reason'] = reason
# + ngx.say(reason)
# + ngx.exit(403)
# +end
# +
# +
# +-- Use same static values as were used to mint the origin token
# +
# +vidpath = string.sub(ngx.var.uri,2)
# +ip = ngx.var.remote_addr
# +secret = ngx.var.secret
# +
# +
# +-- ngx.header['X-Tk-Debug'] = 'Validating for ip ' .. ip .. ' and path ' .. vidpath
# +
# +local provided = ngx.var.arg_t
# +local expires = tonumber(ngx.var.arg_e)
# +
# +if provided == nil or expires == nil
# +then
# + denyaccess('Missing Token')
# +end
# +
# +
# +local now = os.time()
# +-- ngx.header['X-Tk-Timings'] = 'Now: ' .. now .. ' Expiry: ' .. expires
# +
# +if (now > expires)
# +then
# + denyaccess('Token Expired')
# + return
# +end
# +
# +local nowtok = mint_token(vidpath,expires,ip,secret)
# +
# +
# +-- ngx.header['X-tk-vals'] = "Provided " .. provided .. " Calc " .. nowtok
# +
# +if nowtok ~= provided
# +then
# + denyaccess('Token Invalid')
# +else
# + ngx.exit(ngx.OK)
# +end
#