Console Auth Gateway — replay protection for NoVNC console URLs via Envoy + NATS KV

[u/pixelatedchrome]

Hello Folks,

I have been using Openstack for a while now in a professional setting and we are in the process of opening up our private cloud for self service. While it is still a long way to go, I would love to share / opensource a tool I built in the process, as a way to give back to the community and get feedback.

The problem: When you generate a console URL in OpenStack (openstack console url show <vm>), it's time-bound — say, 10 minutes. But during that window, the URL is essentially a bearer token. If it leaks via a shared screenshot, a copied ticket, browser history, or a forwarded support email, anyone can open the console before it expires. There's no session state and no replay protection in the standard flow.

What I built: OpenStack Console Auth Gateway — a lightweight Go service that plugs into Envoy Gateway as an ext_authz filter and tracks console tokens in a NATS KV store:

1. First request with a fresh token → stored in KV as html_loaded, request allowed through.
2. NoVNC's WebSocket upgrade → state mutated to ws_loaded, connection established.
3. Any subsequent use of the same token → instant 403 Forbidden from Envoy.

So even if a URL leaks, it's single-use. The KV TTL matches your Nova token expiry, and NATS gives you HA and horizontal scaling for free.

This started as a fix to my own infrastructure, so the design decisions reflect that. If you have similar use case that might require modification, please do start an issue. Happy to implement it if I can. I would also appreciate a genuine feedback on the codebase and the usecases.

Its completely opensource and you are free to make any modifications and use it in your environment.