Skip to content

Conversation

@JonathanFinch-awin
Copy link
Contributor

@JonathanFinch-awin JonathanFinch-awin commented Oct 27, 2025

Our server is running in Europe/London, at 26 OCT 2025 UTC 00:01:00, we had a load of errors for 1 hour:

AsyncAws\Core\Exception\Http\ClientException: HTTP 403 returned for "https://sqs.eu-west-1.amazonaws.com/".

Code:    InvalidSignatureException
Message: Signature not yet current: 20251026T010057Z is still later than 20251026T001557Z (20251026T000057Z + 15 min.)

We understand the culprit to be at these lines:

$now = $context->getCurrentDate() ?? new \DateTimeImmutable();
// Signer date have to be UTC https://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html
$now = $now->setTimezone(new \DateTimeZone('UTC'));

At 26 OCT 2025 UTC 00:01:00, on a server set to Europe/London, DateTimeImmutable yields:

$date = new DateTimeImmutable();
var_dump($date);
class DateTimeImmutable#1 (3) {
  public $date =>
  string(26) "2025-10-26 01:01:03.078020"
  public $timezone_type =>
  int(3)
  public $timezone =>
  string(13) "Europe/London"
}

Then when the timezone is updated as seen in the code:

$updated = $date->setTimezone(new \DateTimeZone('UTC'));
var_dump($updated);
class DateTimeImmutable#3 (3) {
  public $date =>
  string(26) "2025-10-26 01:01:03.078020"
  public $timezone_type =>
  int(3)
  public $timezone =>
  string(3) "UTC"
}

The time is inconsistent with the real UTC time at that given moment, hence the error.

If we force the instantiation of the date to include UTC which is covered in this PR, at 26 OCT 2025 UTC 00:01:00 the DateTime is instantiated as expected.

$dateUtc = new DateTimeImmutable('now', new DateTimeZone('UTC'));
var_dump($dateUtc);
class DateTimeImmutable#2 (3) {
  public $date =>
  string(26) "2025-10-26 00:01:03.078122"
  public $timezone_type =>
  int(3)
  public $timezone =>
  string(3) "UTC"
}

Then if the timezone is set to UTC, as seen in the code, it has no effect.

$updated = $dateUtc->setTimezone(new \DateTimeZone('UTC'));
var_dump($updated);
class DateTimeImmutable#5 (3) {
  public $date =>
  string(26) "2025-10-26 00:01:03.078122"
  public $timezone_type =>
  int(3)
  public $timezone =>
  string(3) "UTC"
}

We believe this would prevent the error. Unfortunately, as this relies on the system time being modified, it is very difficult to set up a unit test case to prove this behaviour.

Closes #1658

@stof
Copy link
Member

stof commented Oct 27, 2025

Indeed. The root cause of the issue being that 2025-10-26 01:01:03.078020 Europe/London is ambiguous time due to the DST change.

@stof
Copy link
Member

stof commented Oct 27, 2025

Please add the changelog entry for this fix

@JonathanFinch-awin
Copy link
Contributor Author

Please add the changelog entry for this fix

Done. Thanks 👍

### Fixed

- Buffer the response in temporary file to avoid issues when stream is used by another request's body
- SignerV4: Force 'now' to be in UTC when signing requests
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest document that as Fix signing request during DST change instead. The changelog should explain what user-visible we fixed, not how we fixed it (if they care about the implementation of the fix, they can look at the diff of the commit)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, good point, I've updated it and updated the commit message.

@stof stof merged commit 96987fd into async-aws:master Oct 28, 2025
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Suspected DST-sensitivity in credential expiration logic

2 participants