3 Nov 01:05
How to build a download token rule using a keyed hash ?
John Wigley <johnwigley <at> acorna.co.uk>
2009-11-03 00:05:56 GMT
2009-11-03 00:05:56 GMT
Hi all,
I've unsuccessfully been trying to create an example rule(s) that checks http requests for the presence of an authentication token, and blocks requests which do not contain a valid token.
For example:
http://downloadserver.tld/protected1.doc?token=nnnnnnnnnnn:xxxxxxxxxx
Where nnnnnnnnnnn is the desired unix epoch timestamp that the token expires, and
xxxxxxxxxx is a HEX encoded keyed hash constructed for example as SHA1("secret value" + "full file URL" + expiry time unix timestamp)
I've unsuccessfully been trying to create an example rule(s) that checks http requests for the presence of an authentication token, and blocks requests which do not contain a valid token.
For example:
http://downloadserver.tld/protected1.doc?token=nnnnnnnnnnn:xxxxxxxxxx
Where nnnnnnnnnnn is the desired unix epoch timestamp that the token expires, and
xxxxxxxxxx is a HEX encoded keyed hash constructed for example as SHA1("secret value" + "full file URL" + expiry time unix timestamp)
The rule would then have to verify two just
things:
1) That the current unix epoch time <= nnnnnnnnnnn
&
1) That the current unix epoch time <= nnnnnnnnnnn
&
2) That xxxxxxxxxx =
SHA1("secret value" + "full file URL" + nnnnnnnnnnn)
I would be extremely grateful if someone could
point me in the right direction with even a partial example of how to
accomplish the hash comparison as a ModSecurity rule.
The exact format of the token is NOT important and
it could be redesigned to whatever makes it easiest to verify with a ModSecurity
rule. So for example the nnnnnnnnnn and xxxxxxxxx could be split up as
?tokenexpiry=nnnnnnnnn&tokenmac=xxxxxxxxx if that made it easier to verify.
Similarly the hash construction could also be changed if needed.
As far as I can see this should be fairly straight
forward to achieve in ModSecurity because it has the built in Transformation
functions for hashes SHA1 and MD5, a hexEncode as well as the TIME_EPOCH. variable
holding the current timestamp.
I realise that this could be done in a LUA script
also but I am trying to avoid that for performance and simplicity reasons.
I would have thought that a token based download
rule would've been discussed before (and would be a fairly useful and
common requirement) but a long Google search and of the list archives hasn't
turned up anything.
I will happily write up the solution for a FAQ
entry when/if achieved.
Thanks in advance for any assistance,
John
------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference
_______________________________________________ mod-security-users mailing list mod-security-users <at> lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Appliances, Rule Sets and Support: http://www.modsecurity.org/breach/index.html
RSS Feed