hmac-proxy.conf

server {
  listen $HMAC_LISTEN;

  location / {

    access_by_lua_block {

      local hmac_file_whitelist = "$HMAC_FILE_WHITELIST"
      if (hmac_file_whitelist ~= nil and hmac_file_whitelist ~= '') then
        for whitelist_path in string.gmatch(hmac_file_whitelist, '([^,]+)') do
      	  if string.match(ngx.var.request_filename, whitelist_path) then
            return
          end
      	end
      end

      local hmac_signing_key = "$HMAC_SIGNING_KEY"

      local hmac = require "resty.hmac"
      local hmac_256 = hmac:new(hmac_signing_key, hmac.ALGOS.SHA256)

      local url = require "net.url"
      local params = ngx.req.get_uri_args()

      if next(params) == nil then
        local referer = url.parse(ngx.var.http_referer)
        params = referer.query
      end

      local code = params["hmac"]
      if code == nil or code == '' then
        return ngx.exit(401)
      end

      local hashedParams = {"code", "locale", "shop", "state", "timestamp"}
      for k, _ in pairs(params) do
        local foundParam = false
        for index = 1, #hashedParams do
          if k == hashedParams[index] then
            foundParam = true
            break
          end
        end
        if not foundParam then
          params[k] = nil
        end
      end

      table.sort(params)
      local hash_query = url.buildQuery(params)

      local signature = hmac_256:final(ngx.unescape_uri(hash_query), true)
      hmac_256:reset()

      if code ~= signature then
        return ngx.exit(401)
      end
    }
    proxy_pass $HMAC_PROXY_BASE_URL$request_uri;
    proxy_read_timeout $HMAC_PROXY_READ_TIMEOUT;
    proxy_send_timeout $HMAC_PROXY_SEND_TIMEOUT;
  }
}