NOOB: using ngx.var.MYVAR in a location block, *after* content_by_lua

[steward@...]

 

New to nginx_lua. Please be gentle ;)
A few days of researching and experimenting with encouraging results.
But time to make sure I am not heading into the wilderness of stupid.
Appreciate any advice.

Here I am serving HLS index files (m3u8) and wish to protect them (surprise).

====================
location ~ ^/fetch/(?<tok>.+)$ {
    set $r 'raisin';
    content_by_lua '
       local cjson = require "cjson"
       local jwt = require "resty.jwt"
       local jwt_obj = jwt:verify("lua-resty-jwt", ngx.var.tok)
       ##ngx.say(cjson.encode(jwt_obj)) WORKS
       ngx.var.r = "in the sun";
    ';
    add_header "X-Reason" "$r";  ## just testing. Does it fail to update because it is a header? 
    ## proxy_pass will go here?
    ## log user_id of expired or bad hash
}

====================

I experimented with JWT (https://jwt.io/) and discovered I can pack the info I need into a JWT string and still have  a URL under 150 bytes.

So I want to use the JWT in the url. The location above receives it as $tok, and decodes it correctly into json.

Now I need to perform some checks, log any issues, and proxy_pass a valid request to an internal location.

The  json object that gives a user_id, an expiry time, and a "real" location.

I need to "copy" the variables from lua to nginx. I think ngx.var.VARNAME = "value" within content_by_lua is what I need.

QUESTION #1

I set $r="raisin" to initialize the variable as directed at https://github.com/openresty/lua-nginx-module#ngxvarvariable

I know the content_by_lua block is executed correctly (trust me). But the extra header X-Reason is always "raisin" and never "in the sun".

I expected to see the X-Reason header changed in the content_by_lua block.

I suspect I am still thinking/reading procedurally, and that is not what is happening. But I'm not really able to explain why this is so.

How can I use lua vars outside the content_by_lua block ? Or is that a  bad idea that I should avoid?

QUESTION #2

I notice the docs say "WARNING: This API requires a relatively expensive metamethod call and it is recommended to avoid using it on hot code paths." and this depresses me ;)

Am I correct to guess "hot code" means a location that has frequent hits? In this case I am serving m3u8 segments, so I expect frequent hits.

Is this a show stopper?

QUESTION #3

Am I nuts?

I liked the idea of serving a JWT url (without the header) because I think it is very secure.
But to finish I need to...

a) check the expiry time. If expired, log the bad user and die with 403.

b) if good, proxy_pass to the given url (given in the json object).  Ideally this comes to me as eg {url: 1234/foo} and I explode the folder and add on the m3u8 extension, so that I go to an internal location with a full url, eg domain/media/1/2/3/4/foo.mu3u8

Simple in most languages I know, but with nginx+lua I can see it will take some effort from me. Hard to be sure what will go inside content_by_lua and what will remain in the location block for nginx.

So before I kill myself... am I nuts? Is this reasonable, or am I asking too much of ngix+lua?
In particular, is this the sort of thing the WARNING is directed at?

Are there other bits of LUA I should be looking at here that would achieve the same thing without the WARNING? ;) 

Thank your for reading.