use table for environment variables

.gitignore

@@ -1,2 +1,3 @@
 redis
+sus
 .env

docker-compose.yml

@@ -6,6 +6,10 @@ services:
     ports: [ "8430:80" ]
     environment:
       - SECRET=${SECRET}
+      - MAX_AGE_MS=${MAX_AGE_MS}
+    restart: unless-stopped
   redis:
+    hostname: sus-redis
     image: redis:7
     volumes: [ "./redis:/data" ]
+    restart: unless-stopped

main.go

@@ -24,6 +24,8 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strconv"
+	"time"
 
 	"github.com/go-redis/redis/v8"
 	"github.com/gorilla/mux"
@@ -31,17 +33,19 @@ import (
 )
 
 var client = redis.NewClient(&redis.Options{
-	Addr:     "redis:6379",
+	Addr:     "sus-redis:6379",
 	Password: "",
 	DB:       0,
 })
 
 var SECRET string
 var INDEX_GET_REDIRECT = "http://alv.cx"
+var MAX_AGE_MS int64 = 500
 
 func main() {
 	r := mux.NewRouter()
 	r.HandleFunc("/{shortlink}", shortlinkHandler)
+	r.HandleFunc("/{shortlink}/", shortlinkHandler)
 	r.HandleFunc("/", indexHandler)
 
 	listenAddress := "0.0.0.0:80"
@@ -58,6 +62,14 @@ func main() {
 		INDEX_GET_REDIRECT = p
 	}
 
+	if p, ok := os.LookupEnv("MAX_AGE_MS"); ok {
+		if v, err := strconv.ParseInt(p, 10, 64); err != nil {
+			fmt.Printf("Unable to parse environment variable MAX_AGE_MS: %v\n", p)
+		} else {
+			MAX_AGE_MS = v
+		}
+	}
+
 	log.Fatal(http.ListenAndServe(listenAddress, r))
 }
 
@@ -73,16 +85,29 @@ func indexHandler(w http.ResponseWriter, r *http.Request) {
 	command := r.PostForm.Get("Command")
 	shortlink := r.PostForm.Get("Shortlink")
 	value := r.PostForm.Get("Value")
-	fmt.Printf("command: %v, shortlink: %v, value: %v\n", command, shortlink, value)
+	req_timestamp := r.PostForm.Get("Timestamp")
-	fmt.Println(shortlink)
+	req_timestamp_int, err := strconv.ParseInt(req_timestamp, 10, 64)
-	fmt.Println(value)
+	if err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte("Bad request"))
+		return
+	}
+
+	cur_timestamp := time.Now().UnixNano()
+	if req_timestamp_int+MAX_AGE_MS*1000*1000 < cur_timestamp {
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte("Bad request"))
+		return
+	}
+
+	fmt.Printf("req_timestamp: %v, command: %v, shortlink: %v, value: %v\n", req_timestamp, command, shortlink, value)
 
 	signature := r.Header.Get("Signature")
 	calculatedSignature := fmt.Sprintf(
 		"SUS-SIGNATURE-%v",
 		getSha256HMACSignature(
 			[]byte(SECRET),
-			command+":"+shortlink+":"+value,
+			req_timestamp+":"+command+":"+shortlink+":"+value,
 		),
 	)
 

readme.md

@@ -33,12 +33,14 @@ flag is not provided.
 
         docker-compose up -d --build
 
-#### server environment variables
+### server environment variables
 
-- `SECRET`---the secret used for signature verification
+| Variable             | Default         | Description                                                                            |
-- `LISTEN_ADDRESS`---the address the server is listening on (default is `0.0.0.0:80`)
+|----------------------|-----------------|----------------------------------------------------------------------------------------|
-- `INDEX_GET_REDIRECT`---the URL the user should be redirected to if they try to access `/` on the
+| `SECRET`             | N/A             | the secret used for signature verification                                             |
-   server (default is `http://alv.cx`)
+| `LISTEN_ADDRESS`     | `0.0.0.0:80`    | the address the server is listening on                                                 |
+| `INDEX_GET_REDIRECT` | `http://alv.cx` | the URL the user should be redirected to if they try to access `/` on the server       |
+| `MAX_AGE_MS`         | 500             | how old a request can be (in milliseconds) before the server will refuse to process it |
 
 ### setting up susmng
 

susmng.py

@@ -8,6 +8,7 @@ import pathlib
 import os
 import json
 import sys
+import time
 
 
 def get_args():
@@ -51,20 +52,34 @@ def main(args):
     if args.command == "delete" and args.value != "confirm":
         print("--value not set to 'confirm'... delete operation may fail")
 
-    r = requests.post(f"{'http' if args.http else 'https'}://{server}",
+    # accoring to python documentation (https://docs.python.org/3/library/time.html#time.time)
-            data = {
+    # this function does not explicitly have to use unix time, and implementation is dependent
-                'Command': args.command,
+    # platform.
-                'Shortlink': args.shortlink,
+    # most platforms (windows, unix) will probably give unix time though.
-                'Value': args.value,
+    #
-                },
+    # the server side (main.go file) does explicitly use unix time (time.Now().UnixNano()) to get
-            headers = {
+    # this number, but hopefully there should be no issues on most platforms.
-                'Signature': 'SUS-SIGNATURE-' + hmac.new(
+    timestamp = str(time.time_ns())
-                    secret.encode("UTF-8"),
+
-                    (args.command+":"+args.shortlink+":"+args.value).encode("UTF-8"),
+    data = {
-                    hashlib.sha256
+        'Command': args.command,
-                    ).hexdigest()
+        'Shortlink': args.shortlink,
-                }
+        'Value': args.value,
-            )
+        'Timestamp': timestamp,
+        }
+
+    headers = {
+        'Signature': 'SUS-SIGNATURE-' + hmac.new(
+            secret.encode("UTF-8"),
+            (timestamp + ":" + args.command + ":" + args.shortlink + ":" + args.value).encode("UTF-8"),
+            hashlib.sha256
+            ).hexdigest()
+        }
+
+    print(f"{data=}")
+    print(f"{headers=}")
+
+    r = requests.post(f"{'http' if args.http else 'https'}://{server}", data=data, headers=headers)
     print(r, file=sys.stderr)
     print(r.content.decode().strip())
     return 0