-
Notifications
You must be signed in to change notification settings - Fork 71
Suggestion: Make http request signing safe from multiple goroutines #13
Comments
This is a valid concern. I'll look into it soon, and others are welcome to as well. Thanks for bringing it up! |
That synchronizes the signing, but clients still must write to the package global Keys manually whenever credentials are updated. If that happens more often than at program start (i.e. in |
@peterbourgon This is true. I just glanced at the code again, and the only time that I can see that the credentials are updated within the package is when a signing request is made, and fortunately, those are all within the mutex (the |
Well, it's not just a good idea—it's a data race if you don't. Actually, even if you claimed that local Problems, as I see them:
I'm afraid the current architecture is inherently unsafe. The |
Is changing the credentials something you do frequently? |
Of course. Imagine a program that uses multiple credentials to make distinct requests on different periodic intervals. |
Alright, we'll use issue #14 to resolve this; thanks! |
Since working with the http.Client and creating new requests is usually safe from multiple goroutines, I would like to suggest either guarding the things in awsauth that manipulates http.Requests with a mutex or getting rid of the shared states as well.
I'm not entirely sure which parts of it might need changes but the race detector complained on using Sign4 for my requests on multiple routines.
The text was updated successfully, but these errors were encountered: