In the previous section we have used the bearer.ok function
to verify the signature of a JWT token. The function was invoked from
a LuaMath conditional and the shared secret used to verify
signatures was given to it as an argument:
Not LuaMatch "bearer.ok" "secret"
Keeping security-sensitive data, such as secret, in the configuration file requires tightening the file permissions. Depending on the configuration, it can have other security implications as well. All in all, it is better to separate security-sensitive data and configuration.
Pound provides a way of doing so: the Constant
statement:
Constant name -file file
The content of the file file is read and assigned to the
constant name. The constant can then be used in string
expansions, using the const accessor, or can be retrieved
directly from the Lua code, using the http.const(name)
function.
Returning to our example from the previous section, to separate the
shared key value from the configuration text, we first store the value
of key in the file secret.txt. For simplicity, let’s suppose
the file is kept in the pound include directory
(see include directory).
Then, let’s define the constant key and assign it the value
of the shared secret from this file.
Finally, we pass its value to bearer.ok using the
const accessor:
Service
Constant "key" -file "secret.txt"
Not LuaMatch "bearer.ok" "%[const key]"
Rewrite response
SetHeader "WWW-Authenticate: Bearer realm=\"Restricted access\""
End
Error 401
End
Yet another way of achieving the same effect would be to modify the
bearer.ok function to take the constant name as its second
argument and retrieving its value using the http:const method
(see const). This is left as an exercise for the reader.
The Constant statement normally reads the file verbatim and
treats its content as opaque binary data. It is common, however, to
keep textual data there and to maintain it using a text editor. In
this case you will need to remove the trailing newline character that
most editors will add to the end of file. To do so, use the
-trim option, like that:
Constant "key" -file "secret.txt" -trim
As with other configuration statements, in lieu of -file, you
can use -filewatch, the difference between the two being that
the latter will automatically update the value of the constant
whenever the file contents changes. See File-based Conditions, for
a detailed discussion of that.
Finally, notice that Constant can appear in several
configuration scopes, namely: at the top level, inside a
ListenHTTP (or ListenHTTPS), or inside a Service
section. Defining the same constant name inside a deeper scope
silently overrides any definitions in upper scopes. For example, if
you have
Constant "key" -file "one.txt"
ListenHTTP
Constant "key" -file "another.txt"
Service
Constant "key" -file "yetanother.txt"
LuaMatch "func" "%[const key]"
...
then the function func in the last line will be called with the
contents of file yetanother.txt as its argument.