{"id":22065963,"url":"https://github.com/iij/pta","last_synced_at":"2025-05-13T01:53:25.197Z","repository":{"id":41045187,"uuid":"116751759","full_name":"iij/pta","owner":"iij","description":"Period of Time Authentication module for NGINX","archived":false,"fork":false,"pushed_at":"2025-01-23T00:43:39.000Z","size":130,"stargazers_count":4,"open_issues_count":2,"forks_count":6,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-05-13T01:53:17.617Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/iij.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-01-09T01:56:22.000Z","updated_at":"2025-01-23T00:43:43.000Z","dependencies_parsed_at":"2024-11-30T19:26:25.861Z","dependency_job_id":"2f0db011-c8fc-46ed-89d5-57ce076cdbc1","html_url":"https://github.com/iij/pta","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iij%2Fpta","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iij%2Fpta/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iij%2Fpta/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iij%2Fpta/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/iij","download_url":"https://codeload.github.com/iij/pta/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253856628,"owners_count":21974576,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-30T19:22:52.807Z","updated_at":"2025-05-13T01:53:25.176Z","avatar_url":"https://github.com/iij.png","language":"Perl","funding_links":[],"categories":["Authentication"],"sub_categories":[],"readme":"\nOverview\n========\n\nPTA(Period of Time Authentication) module is a module for NGINX. Using\nPTA you can control access to your contents. PTA calcurates a\nencrypted query string or cookie parameter that includes an expiration\ntime and a path of the content.\n\nHow to build\n============\n\nadd path to which you've download PTA as the parameter of configure\nfor NGINX.\n\ne.g.\n\n```\n  $ ./configure --add-module=/somewhere/pta\n\n  $ make\n\n  # make install\n```\n\nUsage\n=====\n\nIt's an example of nginx.conf below.\n\n```\n  worker_processes  1;\n  \n  events {\n      worker_connections  1024;\n  }\n   \n   \n  http {\n      include       mime.types;\n      default_type  application/octet-stream;\n   \n      sendfile        on;\n   \n      keepalive_timeout  65;\n   \n      server {\n          listen       80;\n          server_name  localhost;\n   \n          pta_1st_key 0102030405060708090a0b0c0d0e0f00;\n          pta_1st_iv  00000000000000000000000000000000;\n          pta_2nd_key 11111111111111111111111111111111;\n          pta_2nd_iv  22222222222222222222222222222222;\n   \n          location / {\n              root   html;\n              index  index.html index.htm;\n          }\n   \n          location /foo/ {\n              pta_enable on;\n          }\n   \n          error_page   500 502 503 504  /50x.html;\n          location = /50x.html {\n              root   html;\n          }\n      }\n  }\n```\n\n\npta_1st_key\n-----------\n- Syntax  : pta_1st_key   keystring\n- Default : -\n- Context : server\n\n\npta_1st_iv\n----------\n- Syntax  : pta_1st_iv   ivstring;\n- Default : -\n- Context : server\n\n\npta_2nd_key\n-----------\n- Syntax  : pta_2nd_key   keystring;\n- Default : -\n- Context : server\n\n\npta_2nd_iv\n----------\n- Syntax  : pta_2nd_iv   ivstring;\n- Default : -\n- Context : server\n\n\npta_enable\n----------\n- Syntax  : pta_enable   on | off;\n- Default : pta_enable off;\n- Context : location\n\npta_auth_method\n---------------\n- Syntax  : pta_auth_method qs | cookie | qs cookie;\n- Default : pta_auth_method qs;\n- Context : location\n\n\nHow it works\n============\n\nPTA module decrypts a query string or cookie parameter starting from\n`pta=...' and check CRC32, expiration time and requested URI path\nembedded in it. So you need to generate PTA token and add it to a link\nas query string or cookie parameter. There are some codes under the\nsmaples directory to generate PTA.\n\nformat\n------\n\nThis byte stream is encrypted with the AES AES 128 bit CBC mode.\n\n```\n  +---------------+-------------------------+----------+-----------------+\n  | CRC32 (4byte) | Expiration Time (8byte) | URI Path | Padding         |\n  |               | Unix Time format        |          | pkcs #7 format  |\n  +---------------+-------------------------+----------+-----------------+\n```\n\n### CRC32\nIt's big endian. It's calculated from the Expiration Time and URI Path.\nThis part is used to check that AES decryption is valid.\n\n### Expiration time\nIt's big endian. It's compared with the time that request is arrived\nand if the time is less than or equal to the expiration time that is\ncontained in the PTA token the request is permitted.\n\n### URI Path\nBasically it must be identical with the path of requested content.\n\n  e.g.\n  http://example.com/index.html -\u003e /index.html\n\nIt must be started from the slash `/'.\n\nThe asterisk character `*' means wildcard.\n\n- The `\\*' character must be only one.\n  e.g. /foo/\\*/bar/*.jpg isn't allowed.\n  \n- You can use the `*' character any part such as a part of directory\n  name, file name or file name suffix.\n  \n- If you use the `*' character literally, you must escape it with the\n  back slash.\n\nQuery string and Cookie\n=======================\n\npta_auth_method directive can specify the method to authenticate. \nYou can choose the type of query string, cookie, or both as the method.\n\nIn case of both, query string is evaluated first, and then cookie\nis done if pta parameter isn't included in query string.\nWhen pta parameter in query string isn't valid the authentication \nfails, not fallback to ealuate cookie. Only without pta parameter\nin query string cookie is evaluated.\n\n\u003c!--\n# Local Variables:\n# mode: auto-fill\n# coding: utf-8-unix\n# End:\n--\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fiij%2Fpta","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fiij%2Fpta","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fiij%2Fpta/lists"}