fix(key-auth): validate the configured headernames

[Tieske]

adds validation of header names (was completely absent)
due to nginx/openresty config the '_' is also considered an invalid
character.

Issues resolved

Fixes #2013

[thibaultcha]

Really don't like the actual implementation and dumping it in utils, but I guess it'll do the job.

[Tieske]

@thibaultcha

utils is the place for re-usable utility functions no? where else to put it?

What specifically don't you like about the implementation?

[thibaultcha]

So far this code is not used anywhere but in the key-auth schema validation. Therefore, it has no reason for landing in utils by default.

The implementation, aside from not adhering to the conventional code style discussed many times, uses string.match instead of the PCRE ngx_lua API.

Finally, I don't think the pattern is even relevant. Here is a quote from the Nginx documentation:

Valid names are composed of English letters, digits, hyphens, and possibly underscores (as controlled by the underscores_in_headers directive).

letter + digits + hyphens + [underscores]. If we want "invalid" header names, we should then tweak the ignore_invalid_headers directive, which would make this PR irrelevant. If we don't want to (and we probably don't), then this pattern - or ideally, regex - should comply to it.

We're not writing PUC Lua. We're writing LuaJIT in Nginx. I think we should apply ngx_lua idioms and not PUC Lua ones.

[Tieske]

So far this code is not used anywhere but in the key-auth schema validation. Therefore, it has no reason for landing in utils by default.

If it does not land in utils then no one will find it the next time it is needed, and hence will reinvent the wheel. The pure generic-header-validation logic nature makes it a utility function by default. Hence utils seems the better fit imo.

The implementation, aside from not adhering to the conventional code style discussed many times, uses string.match instead of the PCRE ngx_lua API.

Will update. But it is like this in many places where performance is non-critical. So update all matching to PCRE everywhere? through leave-behind-better-than-found policy?

Finally, I don't think the pattern is even relevant. Here is a quote from the Nginx documentation:

Valid names are composed of English letters, digits, hyphens, and possibly underscores (as controlled by the underscores_in_headers directive).

letter + digits + hyphens + [underscores]. If we want "invalid" header names, we should then tweak the ignore_invalid_headers directive, which would make this PR irrelevant. If we don't want to (and we probably don't), then this pattern - or ideally, regex - should comply to it.

hmmm, didn't look there, just implemented the rfc7230 with the additional _ exception.

But I agree to the more restrictive nginx implementation over tweaking the directive.

[Tieske]

@thibaultcha updated style, PCRE and validation restrictions

[thibaultcha]

Manually merged with the correct commit grouping, naming and some style modifications.