LL:NG-provided lua-header snippet -> "writing a global lua variable ('i') which may lead to race conditions between concurrent requests"
my LL:NG 2.0.8 + nginx 1.19.2 instance has lua support enabled.
in protected app vhost, per
https://lemonldap-ng.org/documentation/latest/confignginx
the LL:NG-provided lua headers snippet,
cat /etc/nginx/nginx-lua-headers.conf
auth_request_set $headername1 $upstream_http_headername1;
...
auth_request_set $lmcookie $upstream_http_cookie;
access_by_lua '
i = 1
ngx.req.set_header("Cookie",ngx.var.lmcookie)
while true do
if ngx.var["headername"..i] ~= nil then
ngx.req.set_header(ngx.var["headername"..i],ngx.var["headervalue"..i])
else
break
end
i = i +1
end
';
is included.
on access, nginx logs report,
2020/08/23 14:47:56 [warn] 13669#13669: *1 [lua] _G write guard:12: __newindex(): writing a global lua variable ('i') which may lead to race conditions between concurrent requests, so prefer the use of 'local' variables
stack traceback:
access_by_lua(lemonldap-lua-headers.inc:43):2: in main chunk while sending to client, client: 10.0.1.20, server: example.com, request: "GET /app2 HTTP/2.0", host: "example.com", referrer: "https://auth.llng.example.com/"
reading @
https://github.com/openresty/lua-nginx-module/issues/1558
https://github.com/openresty/openresty/issues/510
editing
access_by_lua '
- i = 1
+ local i = 1
ngx.req.set_header("Cookie",ngx.var.lmcookie)
appears to remove the error.
i've not tested any downstream effects. iiuc, there should be none ...