Need to implement a token validator which can be run in Openresty to validate that a HMAC token provided as part of the URL is valid.
The tokens are minted by the script created in
VID-11 and are a SHA256 HMAC generated based upon a string comprised of the following
vidpath:expiry:clientip
To be considered valid:
- The token must not have expired (i.e.
os.time() >=
expiry)
- The HMAC should validate (i.e. we can regenerate the same string using the secret)
Variables used to supply the token in a request (as per
VID-10) are
t (token) and
e (expiry) in the querystring.
Once the basic functionality is in place, want to look at improving so that a token can be used for segments too (currently we can only force protection for master manifests, otherwise playback would fail). That'll likely involve using
dirname on the path when minting a token, and then adjusting the validator to push the token into a cookie (or similar). That can be dealt with properly later - the prime concern currently being to ensure
VID-11 tokens can be used - but should be kept in mind.
Activity
2019-04-18 14:49:54
local table = table local require = require local string = string local os = os local sha256 = require "lib.sha256" local function mint_token(path,expires,ip,secret) local mint = {path,expires,ip} local mintstr = table.concat(mint,':') -- print mintstr return sha256.hmac_sha256(secret,mintstr) end -- Use same static values as were used to mint the origin token referer = 'https://snippets.bentasker.co.uk/foobar' vidpath = '2019/08/16.m3u8' ip = '127.0.1.1' secret = '1234abcd' httpref = 'https://snippets.bentasker.co.uk/foobar' -- From the token minted earlier local provided = '830a80dfe53cf869251eecb921416b66524b43767b1673177d055cddb826a983' local expires = 1555598449 local now = os.time() if (os.time() > expires) then print("Deny Time") return end local nowtok = mint_token(vidpath,expires,ip,secret) if now == provided then print("Auth") else print("Deny Tok") end2019-04-18 16:13:45
View Commit | View Changes
2019-04-18 16:29:04
- The VID-11 token minter should run the equivalent of
- The validator should do the same with
- Once a token has been successfully validated from the query string, it should be pushed to the client in a cookie
-- To avoid breaking multi-player support, the cookie name should be derived from the path (so that multiple playback urls have distinct cookie names)
The token auth won't recurse down through directories (i.e. if the token is issued for
As this will require changes to be made to both the VID-11 code and this code, I'll raise a new issue to cover the changes so that comments don't need to be duplicated between.
That'll be VID-13
2019-04-18 18:10:49
2019-04-18 18:10:49
2019-04-18 18:10:52