Authentication bypass

[georgebashi]

Hi, I've just been reading this as I want to implement a similar thing but using Github's OAuth instead.

I've noticed from your implementation that your "logged in" check is simply:

if not ngx.var.cookie_AccessToken then
    ...
end

which is trivially bypassed by just creating a cookie named AccessToken. Am I missing something? Do you authenticate that token separately somewhere else?

FWIW in my implementation I'm planning to use ngx.hmac_sha1 to sign a known message and placing that in the cookie value, which I then check is correct when validating the cookie.

I'd be interested to know if you have a different validation scheme or if I've just missed something obvious in the code. Thanks!

[awestendorf]

Great catch, thank you! We've only put this to limited use due to time constraints, but that's a pretty obvious security hole I should patch.

[awestendorf]

A fix for this was pushed out in #4