AudioProxy.Plugs.VerifySignature (audio_proxy v0.4.0)

Copy Markdown View Source

Gate for the signed URL space (API doc §1/§2).

Splits conn.request_path into the signature segment and everything after it, then verifies with AudioProxy.Signature.verify/2 — the signed string is the raw request path, so no re-encoding ambiguity can creep in.

On success the rest-of-path (leading / included) is stashed in conn.assigns[:rest_of_path] for the downstream options/source parsers. On failure the plug halts with the 401 row of AudioProxy.ErrorJSON; a missing signature segment is just another invalid signature.

Invariants downstream code must respect:

  • Parse assigns.rest_of_path, never path_info. The signature covers the raw request path, and conn.path_info cannot reproduce those bytes: Plug.Conn.Adapter builds it by splitting on / and dropping empty segments (/{sig}//a and /{sig}/a collide), and Plug.Router additionally percent-decodes its own copy for route matching. Neither form is the verified byte sequence.
  • The signature covers the path only. The query string and the HTTP method are not signed — never let an unsigned query param influence processing, and don't assume a signed URL is GET-only.
  • rest_of_path can be "/" (a request for /{sig}/ with a valid signature). That carries no options/source; reject it downstream.

Mount this plug on the signed routes only — /health (and later /metrics) live outside the signed URL space and must not pass through it.