swift proxy tempurl function is undocumented

[Tom Fifield]

Swift proxy's filter:tempurl is undocumented in the manual.

The following configuration options are used:
Variable Service module Default
incoming_allow_headers proxy_server filter:tempurl '
incoming_remove_headers proxy_server filter:tempurl 'x-timestamp'
outgoing_allow_headers proxy_server filter:tempurl 'x-object-meta-public-*'
outgoing_remove_headers proxy_server filter:tempurl 'x-object-meta-*'

(more readable view at https://docs.google.com/spreadsheet/ccc?key=0ArysOOuLgF_PdFV0cFV2VkE2WkZUY1RNYjZBd204a0E )

From the code:
"""
TempURL Middleware

Allows the creation of URLs to provide temporary access to objects.

For example, a website may wish to provide a link to download a large
object in Swift, but the Swift account has no public access. The
website can generate a URL that will provide GET access for a limited
time to the resource. When the web browser user clicks on the link,
the browser will download the object directly from Swift, obviating
the need for the website to act as a proxy for the request.

If the user were to share the link with all his friends, or
accidentally post it on a forum, etc. the direct access would be
limited to the expiration time set when the website created the link.

To create such temporary URLs, first an X-Account-Meta-Temp-URL-Key
header must be set on the Swift account. Then, an HMAC-SHA1 (RFC 2104)
signature is generated using the HTTP method to allow (GET or PUT),
the Unix timestamp the access should be allowed until, the full path
to the object, and the key set on the account.

For example, here is code generating the signature for a GET for 60
seconds on /v1/AUTH_account/container/object::

    import hmac
    from hashlib import sha1
    from time import time
    method = 'GET'
    expires = int(time() + 60)
    path = '/v1/AUTH_account/container/object'
    key = 'mykey'
    hmac_body = '%s\\n%s\\n%s' % (method, expires, path)
    sig = hmac.new(key, hmac_body, sha1).hexdigest()

Be certain to use the full path, from the /v1/ onward.

Let's say the sig ends up equaling
da39a3ee5e6b4b0d3255bfef95601890afd80709 and expires ends up
1323479485. Then, for example, the website could provide a link to::

    https://swift-cluster.example.com/v1/AUTH_account/container/object?
    temp_url_sig=da39a3ee5e6b4b0d3255bfef95601890afd80709&
    temp_url_expires=1323479485

Any alteration of the resource path or query arguments would result
in 401 Unauthorized. Similary, a PUT where GET was the allowed method
would 401. HEAD is allowed if GET or PUT is allowed.

Using this in combination with browser form post translation
middleware could also allow direct-from-browser uploads to specific
locations in Swift.

Note that changing the X-Account-Meta-Temp-URL-Key will invalidate
any previously generated temporary URLs within 60 seconds (the
memcache time for the key).
"""

[Tom Fifield (fifieldt)]

https://review.openstack.org/#/c/11964/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/11964
Committed: http://github.com/openstack/openstack-manuals/commit/73e7ae73192735a8794b173f1a62b31122078df5
Submitter: Jenkins
Branch: master

commit 73e7ae73192735a8794b173f1a62b31122078df5
Author: Tom Fifield <email address hidden>
Date: Sat Aug 25 10:35:27 2012 +1000

    Adding additional features section to swift doc

    Adds a new section for additional swift features previously
    undocumented, including: healthcheck, domain remap, cname_lookup,
    and tempurl.

    Information on these can be scant - so I see this patch as more of
    a starting point which can be added to as more becomes known.

    fixes bug 994350
    fixes bug 994352
    fixes bug 994353
    fixes bug 999405

    Change-Id: I3a27ac66c107b6b7c4735f657cf72bb30cae2d74