No support for POST requests

[nadavpld]

It is not quite a bug, rather a request
The requests made by the Lua script are GET requests by default.
In order to enhance security we are not allowing such requests to our authentication backends and therefore had to make a small fix in the Lua script :

     local b, c, h = http.request {
		url = "http://" .. addr .. path,
		method = 'POST',
		headers = headers,
		create = create_sock,
		-- Disable redirects, because DNS does not work here.
		redirect = false
	}

Should the script get the method as a parameter with a default value of GET ?
Anyways, a clarification in the README file will be great, spent some time debugging my code and haproxy.cfg before noticing the request method

Thanks

[TimWolla]

Should the script get the method as a parameter with a default value of GET ?

Yes, for several reasons:

1. It's what nginx does, which is the inspiration for this script.
2. The authentication request is semantically a GET request (“GET the authentication information for the given request”). Specifically a GET request is defined to not modify state which is a desirable property for this kind of sub request.
3. The authentication request is unable to pass the body to the upstream server, requiring that the decision is made based on the headers alone. While POST requests without a body are equivalent to POST request with an empty body which are perfectly valid they are somewhat unusual.

In order to enhance security we are not allowing such requests to our authentication backends

I'm curious: Why would a simple change of the verb improve the security? Specifically for this use case?

Anyways, a clarification in the README file will be great, spent some time debugging my code and haproxy.cfg before noticing the request method

Sure, do you have specific suggestions where to put it? A pull request would be appreciated. If you don't want to create one I can make the necessary adjustments as well.

[TimWolla]

With #37 you are able to specify the desired method, but haproxy-auth-request still does not forward the request body.