Skip to content

SignatureDoesNotMatch for object keys with special characters in cloudserverclient#21

Merged
bert-e merged 5 commits intodevelopment/1.0from
bugfix/CLDSRVCLT-13/v4-signing
Apr 16, 2026
Merged

SignatureDoesNotMatch for object keys with special characters in cloudserverclient#21
bert-e merged 5 commits intodevelopment/1.0from
bugfix/CLDSRVCLT-13/v4-signing

Conversation

@maeldonn
Copy link
Copy Markdown
Contributor

Problem

Object keys containing special characters (spaces, !, ', *, +,
parentheses, unicode, etc.) cause SignatureDoesNotMatch errors on all
backbeat metadata operations (GetMetadata, PutMetadata, etc.).

The Smithy serializer already percent-encodes path parameters when
building the request URL (e.g., spaces → %20). Then the SigV4 signer
re-encodes the path when computing the canonical URI because
uriEscapePath defaults to true, turning %20 into %2520. The
server computes the signature over the single-encoded path (%20), so
the signatures never match.

Simple alphanumeric keys are unaffected because their encoding is
idempotent.

How to reproduce

Call any backbeat route with a key containing a space:

await client.send(new GetMetadataCommand({
    Bucket: 'my-bucket',
    Key: 'file with spaces.txt',
})); // → SignatureDoesNotMatch

Fix

Default signingEscapePath to false in BackbeatRoutesClient and ProxyBackbeatApisClient constructors. This
tells the SigV4 signer to skip re-encoding the already-encoded path.

Callers can still override with signingEscapePath: true if needed.

Issue: CLDSRVCLT-13

@maeldonn maeldonn requested review from a team, DarkIsDude and benzekrimaha April 15, 2026 16:09
@bert-e
Copy link
Copy Markdown

bert-e commented Apr 15, 2026

Hello maeldonn,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options
name description privileged authored
/after_pull_request Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval Bypass the pull request author's approval
/bypass_build_status Bypass the build and test status
/bypass_commit_size Bypass the check on the size of the changeset TBA
/bypass_incompatible_branch Bypass the check on the source branch prefix
/bypass_jira_check Bypass the Jira issue check
/bypass_peer_approval Bypass the pull request peers' approval
/bypass_leader_approval Bypass the pull request leaders' approval
/approve Instruct Bert-E that the author has approved the pull request. ✍️
/create_pull_requests Allow the creation of integration pull requests.
/create_integration_branches Allow the creation of integration branches.
/no_octopus Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity Change review acceptance criteria from one reviewer at least to all reviewers
/wait Instruct Bert-E not to run until further notice.
Available commands
name description privileged
/help Print Bert-E's manual in the pull request.
/status Print Bert-E's current status in the pull request TBA
/clear Remove all comments from Bert-E from the history TBA
/retry Re-start a fresh build TBA
/build Re-start a fresh build TBA
/force_reset Delete integration branches & pull requests, and restart merge process from the beginning.
/reset Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

@maeldonn maeldonn force-pushed the bugfix/CLDSRVCLT-13/v4-signing branch from 9d22579 to 78797e4 Compare April 15, 2026 16:14
@scality scality deleted a comment from bert-e Apr 15, 2026
@bert-e
Copy link
Copy Markdown

bert-e commented Apr 15, 2026

Waiting for approval

The following approvals are needed before I can proceed with the merge:

  • the author

  • 2 peers

Comment thread tests/testSigningSpecialChars.test.ts
Comment thread src/clients/backbeatRoutes.ts Outdated
Comment thread src/clients/bucketQuota.ts Outdated
The Smithy serializer percent-encodes path parameters (spaces → %20),
then the SigV4 signer re-encodes them (%20 → %2520) because
uriEscapePath defaults to true. This causes SignatureDoesNotMatch for
any object key with special characters (spaces, parentheses, !, ', *, +,
unicode, etc.).

Default signingEscapePath to false in BackbeatRoutesClient,
BucketQuotaClient, and ProxyBackbeatApisClient.

Issue: CLDSRVCLT-13
@maeldonn maeldonn force-pushed the bugfix/CLDSRVCLT-13/v4-signing branch from 78797e4 to 6ca42b5 Compare April 16, 2026 08:36
@maeldonn
Copy link
Copy Markdown
Contributor Author

/approve

@bert-e
Copy link
Copy Markdown

bert-e commented Apr 16, 2026

I have successfully merged the changeset of this pull request
into targetted development branches:

  • ✔️ development/1.0

Please check the status of the associated issue CLDSRVCLT-13.

Goodbye maeldonn.

The following options are set: approve

@bert-e bert-e merged commit 6ca42b5 into development/1.0 Apr 16, 2026
4 checks passed
@bert-e bert-e deleted the bugfix/CLDSRVCLT-13/v4-signing branch April 16, 2026 09:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants