openresty nginx search for keyword in post request body data

Question

I have been using openresty nginx for simple request forwarding purpose, it is working as expected, i am forwarding each incoming request to another URL using below code :

        location /app/ {
        proxy_pass      https://example.com/abc/;
        proxy_read_timeout 60s;         
        proxy_pass_header Server;
        proxy_set_header          Host            $host;
        proxy_set_header          X-Real-IP       $remote_addr;
        proxy_set_header          X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header  X-Frame-Options "SAMEORIGIN" always;

and i am logging each POST request with below code :

server {
                  log_format post_logs '[$time_local] "$request" $status '  

                  '$body_bytes_sent "$http_referer" '        

                  '"$http_user_agent" [$request_body]';
      }



location /app/ {
                  access_log  logs/post.log post_logs;
               }

Now my requirement is that before forwarding each request, i want to filter post request body data for specific string/keyword , it should only forwarded to proxy URL https://example.com/abc/ if specific string/keyword is found in post data.

I did some research but did not find anything that helps me achieve this, can anyone help ?

score 0 · Answer 1 · answered Nov 08 '22 at 07:27

0

Don’t know much about Lua, but hopefully this helps:

location /app {
        set $flag_true 1;
        set_by_lua $flag '
            local token = ngx.var.arg_token
            local request_body = ngx.req.get_body_data()
            ngx.req.read_body()

            # do your filtering here 
            if string.find(request_body, "tiger") then
                return ngx.var.flag_true
            end
            return "false"
        ';
        if ($flag = 1) {
            proxy_pass http://x.x.x.x:8092;
            break;
        }
        echo "You do not have permission: $flag";
    }

Inspired by:

Filter request on proxy_pass using lua on nginx

How to check if matching text is found in a string in Lua?

answered Nov 08 '22 at 07:27

PHagemann

71
5

Thanks for reply but If is Evil when used in location context – user3782114 Nov 08 '22 at 09:00
In NGINX it self - OK. But shouldn‘t this be ok as it is inside the lua context? – PHagemann Nov 08 '22 at 09:16
I tried get "nginx: [emerg] "proxy_pass" cannot have URI part in location given by regular expression, or inside named location, or inside "if" statement, or inside "limit_except" block in ./conf/nginx.conf;" Error – user3782114 Nov 08 '22 at 09:25
i did some work on your answer and used it for my scenario, now i am getting error "failed to run set_by_lua*: set_by_lua:4: API disabled in the context of set_by_lua" – user3782114 Nov 09 '22 at 09:33
Could you update my reply or provide your modified script? – PHagemann Nov 09 '22 at 13:21

score 0 · Accepted Answer · answered Nov 25 '22 at 13:18

Finally I got it done with help of lua :

location /app/ {
.
.
.
    
access_by_lua '
            ngx.req.read_body()
            local data = ngx.req.get_body_data()
            local  match = ngx.re.match(ngx.var.request_body, "<reqid>search</reqid>")                      

#local  match = ngx.re.match(ngx.var.request_body, "<reqid>search</reqid>","i") for case insensitive match          
            
            if match then
                #nothing to do
            else
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end';
            proxy_pass      https://example.com/abc/;
            
}

here request body data will be assign to variable 'data' and with use of ngx.re.match we can match string/keyword with request body data, in above example if <reqid>search</reqid> not found in request body then it will return 403 forbidden, if found then it will be passed to proxy_pass.

It can be very useful for filtering incoming request before processing it.

openresty nginx search for keyword in post request body data

2 Answers2