Using the aws s3 sdk

[steffenmllr]

Hey there, first off thanks for the module!
Let's say I want to authenticate certain requests against the official s3 upload client.

This should work right? I always get an valid false ...

var app = require('express')();
var Hmmac = require('hmmac');
var AWS = require('aws-sdk');

var accessKeyId = 's3box';
var secretAccessKey = 's3box';

var hmmac = new Hmmac({
    scheme: Hmmac.schemes.load('aws4'),
    acceptableDateSkew: false,
    debug: 1,
    schemeConfig: {
        region: 's3box',
        service: 's3'
    },
    credentialProvider: function(key, callback) {
        if(key !== accessKeyId) {
            return callback(null)
        } else {
            callback({ key: accessKeyId, secret: secretAccessKey});
        }
    }
});

app.use(function (req, res, next) {
    hmmac.validate(req, function(valid) {
        console.log('This should be valid', valid);
    });
});


var server = app.listen(3000, function () {
    AWS.config.update({
        "accessKeyId": accessKeyId,
        "secretAccessKey": secretAccessKey,
        "region": "s3box",
        "endpoint": "127.0.0.1:3000",
        "maxRetries": 0,
        "s3ForcePathStyle": true,
        "sslEnabled": false,
        "signatureVersion": "v4"
    });

    var s3bucket = new AWS.S3({params: {Bucket: 'fooobar'}});
    s3bucket.createBucket(function(err) {
        console.log(err);
    });

});

[cmawhorter]

Holy crap, so sorry for the late response. Somehow missed the notification, otherwise I would've gotten to you sooner.

Looking at it right now, but it seems to be falling down on the date header for some reason. Setting debug: 2 enables more verbose logging.

Should have more details shortly.

[cmawhorter]

Tracked it down:

hmmac's aws4 needs to more strictly follow http://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html

The problem is hmmac's aws4 expects the date to be in the Date header. Period. However, aws4 says that it could be in x-amz-date header or even in the querystring for GET -- and this is how node aws-sdk sends the date.

Also, if both Date and X-Amz-Date exist, they should match identically or the request is invalid.

Should have a commit shortly, but here's a working copy of your script that includes a workaround: https://gist.github.com/cmawhorter/659b7aeec4ce590e3497