Do you know of a NGiNX module that performs something similar to verification of Amazon Web Service request signatures?

Question

I'd like to restrict access to my web service to registered clients. The first thing I thought of was to mimic that of AWS which, in a nutshell, issues clients a non-secret and secret key pair, and requires clients to prove knowledge of the secret key by using a cryptographic function of some of the HTTP request data and the secret key, then specifying the output of the crypto function in a request header. AWS does the same and checks that the expected signature matches what the client has specified. The secret is not transmitted, blah blah. This is pretty typical and not that interesting albeit useful.

http://mws.amazon.com/docs/devGuide/Signatures.html

http://chrisroos.co.uk/blog/2009-01-31-implementing-version-2-of-the-amazon-aws-http-request-signature-in-ruby

My preferred web server for web services is nginx. I'd like to start requiring similar request signatures in certain services. It makes sense to me to create an nginx module that handles request signature validation before ever sending the request to an upstream process (my web service instance(s)).

Do you know of such a nginx module? Do you know of a different one that I can base my work off of?

There's a decent nginx module writing guide here:

http://www.evanmiller.org/nginx-modules-guide.html

Please note that I'm not asking "how do I write a nginx module?" I'm simply trying to avoid reinventing the wheel.

Thanks!

Answer 1

If I'm understanding correctly, you could simply check for custom headers with an if($http_{yourheader}){} and validate that against a backend such as memcached, or proxy to a fastcgi script, or even use an embedded perl script (although this will be slow and could block).

AFAIK there aren't any specific standard or third-party modules that do this, but a combination of them could provide a suitable solution (eg; $http_{header} + redis backend, for instance).

Is there a particular reason you're not looking to use custom SSL certs? They would seem an adequate solution for restricting access with added security.