0

I've been asked to have a look at whether it's possible to decrypt a header during the processing of the request.

The specific use case is to respond to the decrypted contents of the header by removing another header from the request (if the decrypted data isn't "right"). The data in the encrypted header is being used to validate aspects of the client.

I can see how this can be done easily using mod_headers with an unencrypted header value but I haven't been able to find anything on taking a header, decrypting it and using the resulting value.

Have I missed something or is this just not doable?

2 Answers 2

1

You can do this with mod_rewrite. For example, suppose /path/to/decryption/script is a script that accepts the encrypted header value on its standard input, and outputs either "good" or "bad" according to whether the value is okay.

RewriteEngine on
RewriteMap decryptmap ext:/path/to/decryption/script

# Set environment variable BAD_RESULT if the header decryption fails
RewriteCond %{decryptmap:%{HTTP:Header-to-decrypt}} bad
RewriteRule .* - [E=BAD_RESULT]

# Clear a header if the decryption failed
Header unset Header-to-clear env=BAD_RESULT

You could also include other data in the standard input for the script. For example:

RewriteCond %{decryptmap:%{HTTP:Header-to-decrypt}_%{ENV:varname}_%{HTTP:Another-header}} bad

and have the script pull the values apart. See RewriteCond for a list of the types of values you can use.

The external program will have to run on each new request, so performance could be bad if it's slow in processing each new line.

See "External Rewriting Program" in the RewriteMap documentation for a list of other problems to watch out for when using external rewriting programs.

0

This should be a comment, but it's a bit long.

There are many, many contributory factors you have not addressed in your question which are critical to the structure of any solution, let alone the specifics of the implementation. That you are not already aware of this casts doubt on the accuracy of the information you have provided, your ability to understand the problem, and therefore solve it.

But, giving you the benefit of the doubt...

You will need to the encryption algorithm, the initialisation vector and the encoding of the payload in addition to the encryption key.

You should already know that Apache cannot decrypt the data, meaning you need to send the data elsewhere, but this then begs the question of what you are trying to acheive. Is the header just an adjunct to the message, or is the message in the header. If it is the latter then why is the system designed to work like this?

You seem to be trying to authenticate a request independently of the processing of the request, which implies a mitm proxy operation. Which rather begs the question why are you trying to solve it in Apache which, although it can operate as a proxy, is primarily an origin server.

You could, for example direct the request to a php script and use mcrypt or openssl to decrypt the relevant header, then create a new request to the actual target, but there lots of other ways to solve the problem and this approach is not applicable to all possible scenarios.

1
  • Wow, a five paragraph diatribe and then you actually put something helpful. I evidently didn't know for certain whether or not what I had been asked to do was possible hence the question. Threads such as these serverfault.com/questions/372588/… point to alternatives for file based decryption and were met with helpful responses. I was aware that of course the decryption could be handled elsewhere but that is not what I had been asked to investigate. Thankyou for making my first server fault experience a positive one.
    – ianxh
    Mar 7, 2015 at 20:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .