Skip to content

Update presigner to only hoist headers in v2 presigned URLs #1808

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 22, 2017
Merged

Update presigner to only hoist headers in v2 presigned URLs #1808

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bcbadc8
Update presigner to only hoist headers in v2 presigned URLs
jeskew Nov 22, 2017
ff90391
Update codecov.yml not to error out because we are no longer building…
jeskew Nov 22, 2017
f1516a2
Remove dead code and correct codecov.yml
jeskew Nov 22, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changes/next-release/bugfix-Presigner-6ee59c28.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"type": "bugfix",
"category": "Presigner",
"description": "Update presigner to only hoist headers in v2"
}
1 change: 1 addition & 0 deletions codecov.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,4 @@ coverage:
project:
default:
target: 95%
if_not_found: success
28 changes: 14 additions & 14 deletions lib/signers/presign.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,31 +49,31 @@ function signedUrlSigner(request) {
queryParams = AWS.util.queryStringParse(parsedUrl.search.substr(1));
}

AWS.util.each(request.httpRequest.headers, function (key, value) {
if (key === expiresHeader) key = 'Expires';
if (key.indexOf('x-amz-meta-') === 0) {
// Delete existing, potentially not normalized key
delete queryParams[key];
key = key.toLowerCase();
}
queryParams[key] = value;
});
delete request.httpRequest.headers[expiresHeader];

var auth = queryParams['Authorization'].split(' ');
var auth = request.httpRequest.headers['Authorization'].split(' ');
if (auth[0] === 'AWS') {
auth = auth[1].split(':');
queryParams['AWSAccessKeyId'] = auth[0];
queryParams['Signature'] = auth[1];

AWS.util.each(request.httpRequest.headers, function (key, value) {
if (key === expiresHeader) key = 'Expires';
if (key.indexOf('x-amz-meta-') === 0) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know if there are any headers that we hoist to the query string today that don't also have to be sent as headers when using sigv4 presigned urls? Maybe that's just a feature of sigv2, but I'm wondering if we'll lose out on that feature with this change.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are, and they are all handled here. The current V4 presigner will always produce an invalid signature when any other headers are present.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah ok. So we may want to add additional headers to that section you pointed to in the future, but as of now, this change won't cause any existing cases to break. This part looks good then!

// Delete existing, potentially not normalized key
delete queryParams[key];
key = key.toLowerCase();
}
queryParams[key] = value;
});
delete request.httpRequest.headers[expiresHeader];
delete queryParams['Authorization'];
delete queryParams['Host'];
} else if (auth[0] === 'AWS4-HMAC-SHA256') { // SigV4 signing
auth.shift();
var rest = auth.join(' ');
var signature = rest.match(/Signature=(.*?)(?:,|\s|\r?\n|$)/)[1];
queryParams['X-Amz-Signature'] = signature;
delete queryParams['Expires'];
}
delete queryParams['Authorization'];
delete queryParams['Host'];

// build URL
endpoint.pathname = parsedUrl.pathname;
Expand Down