HMAC Plugin #549
HMAC Plugin #549
Conversation
clock skew check
| return username, signature, algorithm | ||
| end | ||
|
|
||
| local function validate_signature(request, secret, signature, algorithm, defaultClockSkew) |
There was a problem hiding this comment.
doesn't look like we're using the algorithm variable in this function. should it be used in the -- validate signature section or can it be removed as an argument?
There was a problem hiding this comment.
@harlow for now only sha1 would be supported and would be mentioned in the manual, here argument is optional field and any value passed by user will be discarded.
|
|
||
| function _M.execute(conf) | ||
| -- If both headers are missing, return 401 | ||
| if not (ngx.req.get_headers()[AUTHORIZATION] or ngx.req.get_headers()[PROXY_AUTHORIZATION]) then |
There was a problem hiding this comment.
You are calling twice ngx.req.get_headers() (and once in validate_signature and another time in retrieve_hmac_fields). This is an expansive operation and the result should be cached.
Also you have local ngx_set_header = ngx.req.set_header but not the equivalent for get_headers().
There was a problem hiding this comment.
sorry missed it, updating it.
HMAC Plugin