Redis Lua keys need to be declared before the script runs
Redis scripting lets an application perform several operations atomically. It also moves part of the application's data-access logic onto the server. The key names that the script can touch are supposed to be passed explicitly, especially in a cluster where operations on different hash slots cannot be combined arbitrarily.
The Redis documentation states that all names of keys accessed by a script must be provided as input key arguments. This is not only a cluster-routing rule. It gives the server, clients, and ACL review a concrete set of keys to reason about. A script that derives keys from arguments or scans an unknown pattern defeats that clarity.
Declare keys and capabilities
EVAL and EVALSHA take a key count followed by the declared key names. Redis uses that information during execution and cluster routing. Script flags such as no-writes and no-cluster can narrow behavior, but flags do not replace key declaration or authorization. In Redis Cluster, keys in one script must map to a compatible slot, so applications should use a deliberate hash-tag scheme rather than discovering the failure in production.
ACLs add a separate control. A user's permitted commands and categories should match the script's purpose. A read-only consumer should not have a broad scripting role that can execute administrative commands or access unrelated keys. Use ACL DRYRUN where the installed Redis version supports it to check a user's effective permissions without executing the command.
The choice between EVAL, EVALSHA, and Redis Functions affects caching and deployment, not the authorization model. A script loaded with SCRIPT LOAD still needs a key declaration at invocation. A function library is registered and called by name, so library deployment needs its own review, versioning, and removal process.
Test the boundary
Create a test user that can run only the intended command category and keys. Call the script with the correct declared keys and confirm success. Call it with an undeclared key or a key on another slot and confirm the expected failure. Try a script that attempts a write while invoked with a read-only path. Review the server logs for the exact failed command and the user identity.
Audit the application code that builds KEYS and ARGV. A user-controlled account identifier should not become an arbitrary key namespace. Use an allowlist or key-prefix policy and validate the resulting key before execution. Keep scripts in source control, hash their contents, and record which applications call which script.
Redis scripts are not a place to hide a general-purpose command executor. The database API intentionally limits host access, but an over-broad script can still expose every key the calling user is allowed to touch. Declare keys, keep ACLs narrow, and make the cluster's key layout visible to the people reviewing the script.
Top comments (0)