Nginx lua warning: "global lua variable ('openidc_get_path') & ('openidc_get_redirect_uri_path')"

[vavra5]

Environment

• lua-resty-openidc version 1.7.1-1
• OpenID Connect provider Okta
• OpenResty docker container

Expected behaviour

No warnings for global variables.

Actual behaviour

I get these errors in the nginx_log when attempting to go to a path requiring login.

2019/06/07 15:12:21 [warn] 6#6: *1 [lua] _G write guard:12: __newindex(): writing a global lua variable ('openidc_get_path') which may lead to race conditions between concurrent requests, so prefer the use of 'local' variables stack traceback: /usr/local/openresty/luajit/share/lua/5.1/resty/openidc.lua:1311: in main chunk [C]: in function 'require' access_by_lua(lua-resty-openidc.conf:52):21: in main chunk, client: x.x.x.x, server: localhost, request: "GET / HTTP/1.1", host: "localhost"

2019/06/07 15:12:21 [warn] 6#6: *1 [lua] _G write guard:12: __newindex(): writing a global lua variable ('openidc_get_redirect_uri_path') which may lead to race conditions between concurrent requests, so prefer the use of 'local' variables stack traceback: /usr/local/openresty/luajit/share/lua/5.1/resty/openidc.lua:1316: in main chunk [C]: in function 'require' access_by_lua(lua-resty-openidc.conf:52):21: in main chunk, client: x.x.x.x, server: localhost, request: "GET / HTTP/1.1", host: "localhost"

Minimized example

I create a custom OpenResty docker image that adds my nginx.conf and lua-resty-openidc.conf. I'm using docker-compose to start the environment.

Configuration and NGINX server log files

nginx logs

lua-resty-openidc.conf:

lua_package_path '/usr/local/openresty/lualib/resty/?.lua;;';

lua_package_cpath '/usr/local/openresty/lualib/resty/?.so;;';

lua_shared_dict discovery 1m;
lua_shared_dict jwks 1m;
lua_ssl_verify_depth 5;
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

resolver 127.0.0.11 8.8.8.8 ipv6=off;

server {
    access_log /usr/local/openresty/nginx/logs/access.log main;

    error_log /usr/local/openresty/nginx/logs/error.log debug;

    server_name  localhost;

    listen 80 default_server;

    location / {

        access_by_lua_block {
            local opts = {
                redirect_uri = "/redirect_uri",
                discovery = "${DISCOVERY_URL}",
                client_id = "${CLIENT_ID}",
                client_secret = "${CLIENT_SECRET}",
                redirect_uri_scheme = "http",
                logout_path = "/logout",
                post_logout_redirect_uri = "http://localhost/",
                redirect_after_logout_with_id_token_hint = true,
                renew_access_token_on_expiry = true,
                ssl_verify = "yes",
                accept_unsupported_alg = false,
                token_signing_alg_values_expected = { "RS256" },
                access_token_expires_leeway = 30,
                revoke_tokens_on_logout = true,
                token_endpoint_auth_method = "client_secret_basic"
            }

            local res, err = require("resty.openidc").authenticate(opts)
            if err then
                ngx.status = 403
                ngx.say(err)
                ngx.exit(ngx.HTTP_FORBIDDEN)
            end
        }

        expires           0;
        add_header        Cache-Control private;
        proxy_pass  http://localhost:8400;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

    }
}

nginx.conf

worker_processes  auto;

error_log /usr/local/openresty/nginx/logs/error.log debug;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $bytes_sent '
                    '"$http_referer" "$http_user_agent"';

    access_log /usr/local/openresty/nginx/logs/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/lua-resty-openidc.conf;
}

Dockerfile

FROM openresty/openresty:1.15.8.1-1-alpine-fat

# Install ca-certificates to manage ssl
RUN apk add ca-certificates

# install dependencies
RUN ["luarocks", "install", "lua-resty-openidc", "1.7.1-1"]

ADD nginx.conf /usr/local/openresty/nginx/conf/nginx.conf

# nginx primary vhost
ADD lua-resty-openidc.conf /etc/nginx/conf.d/lua-resty-openidc.conf

EXPOSE 80 443

STOPSIGNAL SIGTERM

docker-compose.yml

version: '3'
services:  
  openidc:
    image: my-openresty
    container_name: openidc
    restart: on-failure
    ports:
    - "80:80"
    expose:
    - 80
    links:
    - hello
  hello:
    image: nginxdemos/hello:latest
    container_name: hello
    restart: on-failure
    ports:
    - "8400:80"
    expose:
    - 8400

[bodewig]

Thanks.

We've already fixed this in master - see f753640 - after re-checking the code once #253 had been raised.