Token Verification Function

This documents how Lua code can be used for verifying tokens which protect incoming requests to the ESB3024 CDN Director. See the section about token verification for general information about token verification.

The Lua code is written as a function body in the services.routing.tokens.verification.<n>.luaFunction configuration parameter. The code can access any part of the request, in the same way as a request translation function. It is not limited to taking the token from a query parameter. The token can be placed anywhere.

If the function returns false or nil it means that the token is invalid. Any other value means that the token is valid. It is not possible to send an HTTP request from the Lua function.

Example of a Lua token verification function that expects the request header X-Token to contain the hard-coded token abc:

return request_headers['X-Token'] == 'abc'

Arguments

The following (iterable) arguments will be known by the function:

Headers

• Type: nested table (indexed by number).

• Description: Array of request headers as {[1]='Name',[2]='Value'} pairs that were present in the request. A multi-value header such as Foo: bar1,bar2 will not be split up as multiple headers. It will appear in the token verification function as Headers={..., {[1]='foo',[2]='bar1,bar2'}, ...}.

• Example usage:

  for _, header in pairs(Headers) do
    print(header[1]..'='..header[2])
  end
  

Secrets

• Type: table of string, indexed by number.

• Description: An array containing the secrets that are stored under services.routing.tokens.verification.<n>.secretIds. All secrets are looked up in the secret store before the Lua function is called. If a secret fails to be looked up it will be omitted from the list. If the lookup fails for all secrets, the Lua function will be called with an empty secrets array.

• Example usage:

  return request_headers['X-Token'] == to_hex_string(hmac_sha256(Secrets[1], request.path))
  

QueryParameters

• Type: nested table (indexed by number).

• Description: Array of query parameters as {[1]='Name',[2]='Value'} pairs that were present in the query string of the request.

• Example usage:

  for _, queryParam in pairs(QueryParameters) do
    print(queryParam[1]..'='..queryParam[2])
  end
  

Additional Data

In addition to the arguments above, the following Lua tables, documented in Global Lua Tables, provide additional data that is available when executing the token verification function:

• selection_input
• request
• request_query_params
• request_headers
• session
• session_groups
• session_query_params