2

Apache has a module called mod_unique_id that generates a unique environment variable (UNIQUE_ID) that is unique across all requests. However, its encoding is over the range [A-Za-z0-9@-] instead of the usual base64 [A-Za-z0-9+/].

I would like an environment variable that is unique across all requests that is actually base64 encoded (or at least, to some subset of base64 like hexadecimal).

If I try to create such an environment variable like so:

Define myid "expr=%{base64:UNIQUE_ID}"
SetEnv MYID "%{myid}"

Then MYID has a value that is not regenerated on every new request.

So, my question is this: Can I manipulate UNIQUE_ID so that it is actually base 64, or else can I create an environment variable that is unique to all requests to the server.

4
  • Why would you want it to be 64 (24bits) rather than 144bits? Commented Jul 6, 2018 at 20:02
  • The Content-Security-Policy response header allows you to specify a nonce to the script-src directive. It should be base64 encoded if I remember correctly (although I can't seem to find that written anywhere right now...). UNIQUE_ID may be composed of characters that are invalid in that directive (namely @ and -) so using it as is will not work. Basically I am trying to hack MediaWiki to add a nonce attribute to its inline script tags so I can enforce a CSP.
    – Zorawar
    Commented Jul 7, 2018 at 0:40
  • I'm surprised that expr=%{base64:UNIQUE_ID} won't give you an new value on every request... Have you tried expr=%{base64:UNIQUE_ID}? Do you get a entirely static value? For mediawiki you could also register a auto prepend php file that sets the environment variable.
    – xsrf
    Commented Jul 8, 2018 at 13:51
  • @xsrf:I checked again and the problem appears to be expr=%{base64:UNIQUE_ID}: what this produces is literally "UNIQUE_ID" converted to base 64 -- it has not substituted the value of the variable %UNIQUE_ID. I don't why this should be since I've followed httpd.apache.org/docs/2.4/expr.html
    – Zorawar
    Commented Jul 9, 2018 at 16:54

1 Answer 1

3

NOTE: In case you missed it, in order to use expr=... you need Apache 2.4.10 or later as noted in the "Compatability" line/section of the mod_headers page.

Having clarified that, it still did not work for me using Define .... What worked for me was to add a RequestHeader ... line in httpd.conf (at the global level). The key is to call reqenv(UNIQUE_ID) as the argument to base64():

...
Include conf.modules.d/*.conf

# add the following line
RequestHeader set X-Nonce "expr=%{base64:%{reqenv:UNIQUE_ID}}"
...

Restart apache (in CentOS 7, this would be):

sudo systemctl restart httpd.service

Then from php you can get it via:

$r = apache_request_headers();
echo $r['X-Nonce'];

Alternatively, you can also extract it via $_SERVER:

# notice that it is all in caps with the 'HTTP_' prefix
echo $_SERVER['HTTP_X_NONCE'];

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.