{"id":13288233,"url":"https://github.com/blake/secure-link-filter","last_synced_at":"2025-07-22T05:33:55.938Z","repository":{"id":42865725,"uuid":"258981436","full_name":"blake/secure-link-filter","owner":"blake","description":"Wasm filter to protect access to URL paths","archived":false,"fork":false,"pushed_at":"2023-03-04T14:44:11.000Z","size":16,"stargazers_count":2,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-01T22:34:23.898Z","etag":null,"topics":["assemblyscript","envoy-filter","envoyproxy","wasm-example"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/blake.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-26T08:42:25.000Z","updated_at":"2021-06-06T08:33:37.000Z","dependencies_parsed_at":"2024-12-14T14:46:16.280Z","dependency_job_id":"b01b6ee3-061d-4c05-9de9-4d4cc62d7bce","html_url":"https://github.com/blake/secure-link-filter","commit_stats":{"total_commits":4,"total_committers":1,"mean_commits":4.0,"dds":0.0,"last_synced_commit":"d6dea88974c87b1a83bad1275a340aa373148e9c"},"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/blake/secure-link-filter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blake%2Fsecure-link-filter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blake%2Fsecure-link-filter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blake%2Fsecure-link-filter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blake%2Fsecure-link-filter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/blake","download_url":"https://codeload.github.com/blake/secure-link-filter/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/blake%2Fsecure-link-filter/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266433745,"owners_count":23927808,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-22T02:00:09.085Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["assemblyscript","envoy-filter","envoyproxy","wasm-example"],"created_at":"2024-07-29T16:55:00.873Z","updated_at":"2025-07-22T05:33:55.916Z","avatar_url":"https://github.com/blake.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Secure Link filter\n\nSecure Link is a WebAssembly (WASM) filter written in\n[AssemblyScript](https://docs.assemblyscript.org/) which checks the authenticity\nof requested links and protects resources from unauthorized access. Authenticity\nis verified by comparing the checksum value passed in a request with the value\ncomputed for the request, using the shared secret.\n\nThis filter is *experimental* / proof-of-concept. It is not meant to be used in\nproduction deployments.\n\nIt was inspired by nginx's [Secure Link][ngx_http_secure_link_url] module.\n\n## Requirements\n\n* [Envoy proxy][envoy_url] with WebAssembly support (i.e., [envoyproxy/envoy-wasm][envoy_wasm_url])\n\nThis filter has been tested with Envoy v1.13. It is possible that the filter\nis compatible with newer versions, but it is untested.\n\n## Installation\n\nThe filter can be manually compiled, or installed from\n[WebAssemblyHub.io][webassembly_hub_url].\n\n### Compiling\n\nCompiling the filter requires [`npm`](https://www.npmjs.com/) to be installed.\n\nFirst, clone this repository.\n\n```shell\ngit clone --single-branch https://github.com/blake/secure-link-filter.git\n```\n\nNext, install the required dependencies.\n\n```shell\ncd envoy-secure-link-filter\nnpm install\n```\n\nThen build the filter using `npm run`.\n\n```shell\nnpm run asbuild\n```\n\nThe resultant WASM filter can be found in `./build/optimized.wasm`.\n\n### WebAssembly Hub\n\nThis filter is also available on the [WebAssembly Hub][webassembly_hub_url].\n\nFirst, [Install the wasme CLI][wasme_cli_install].\n\nThen download the filter using the `wasme` client.\n\n```shell\nwasme pull webassemblyhub.io/blake/secure-link:v0.1\n```\n\nRefer to WebAssembly Hub's\n[Deployment Tutorial](https://docs.solo.io/web-assembly-hub/latest/tutorial_code/deploy_tutorials/) docs for information on deploying the filter to various\ntarget platforms.\n\n## Configuration\n\nThe filter requires the following parameters in order to function.\n\n1. Shared Secret\n1. Comma-separated list of URL paths to protect\n\nThe configuration is defined in plain text with each parameter separated by the\npipe (`|`) symbol. For example:\n\n```plaintext\n\u003cshared secret\u003e|\u003cProtected URL paths\u003e\n```\n\nTo configure the filter to use a shared secret of `WASM_rocks!` and protect the\nURL paths `/downloads/` and `/private/`, the resultant configuration would\nappear as follows.\n\n```plaintext\nWASM_rocks!|/downloads/,/private/\n```\n\n## Test the filter\n\nThis section assumes you already have an Envoy proxy running with the filter\nproperly configured.\n\nLets say, for example, that Envoy is listening on localhost port 8080 and we to\naccess a protected resource of `/downloads/videos/wasm-tutorial.mp4`. The filter\nis configured with a shared secret of `WASM_rocks!`.\n\nGenerate the MD5 hash for the URL using the following:\n\n```shell\n$ echo -n 'videos/wasm-tutorial.mp4WASM_rocks!' | openssl md5 -hex\nab94570897eeba7fa391edc4da08c967\n```\n\nIssue an HTTP HEAD request using `curl` to test that you have access to the\nresource.\n\n```shell\ncurl --head localhost:8080/downloads/ab94570897eeba7fa391edc4da08c967/videos/wasm-tutorial.mp4\n```\n\n[envoy_url]: https://www.envoyproxy.io/\n[envoy_wasm_url]: https://github.com/envoyproxy/envoy-wasm\n[ngx_http_secure_link_url]: http://nginx.org/en/docs/http/ngx_http_secure_link_module.html\n[proxy_runtime_url]: https://github.com/solo-io/proxy-runtime\n[wasme_cli_install]: https://docs.solo.io/web-assembly-hub/latest/tutorial_code/getting_started/#install-the-wasme-cli\n[webassembly_hub_url]: https://webassemblyhub.io/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fblake%2Fsecure-link-filter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fblake%2Fsecure-link-filter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fblake%2Fsecure-link-filter/lists"}