remove TTL from is_timed_hmac_valid_v0

[teal kraken]

Hello, is it possible to disable the TTL, so WAF only used for verifying the hmac without checking expiration, thankyou

(http.host eq "mydomain.com" and not is_timed_hmac_valid_v0("mysecret", http.request.uri, 300, http.request.timestamp.sec, 8))

[dark peak]

Nope

[teal kraken]

I see, but I can make it for 50 years, then I update it 50 years later, correct ?

[dark peak]

Sure?

Might be limited to 2038 due to 32bit unix timestamp, idk

Try it

[teal kraken]

do you think is_timed_hmac_valid_v0 can receive value from header instead of http.request.uri ?

[teal kraken]

this should not be a problem, as it store second, not epoch

[dark peak]

Thats epoch

[teal kraken]

yeah, but It's not like defining epoch since 1970 correct?, it a second addition until expired (like 300 on the rule above)

[dark peak]

??

[teal kraken]

thanks leo

[dark peak]

http.request.timestamp.sec is unix timestamp

[teal kraken]

I don't understand, it's should be on cloudflare to maintain it's data type, correct ?

[dark peak]

.

[teal kraken]

nice seems working

if not valid hmac or expired, then redirect to rick astley