feat: s3 Signed URLs

Author: fenos

src/config.ts

@@ -103,6 +103,7 @@ type StorageConfigType = {
   s3ProtocolEnforceRegion: boolean
   s3ProtocolAccessKeyId?: string
   s3ProtocolAccessKeySecret?: string
+  s3ProtocolNonCanonicalHostHeader?: string
   tracingMode?: string
 }
 
@@ -232,6 +233,9 @@ export function getConfig(options?: { reload?: boolean }): StorageConfigType {
     s3ProtocolEnforceRegion: getOptionalConfigFromEnv('S3_PROTOCOL_ENFORCE_REGION') === 'true',
     s3ProtocolAccessKeyId: getOptionalConfigFromEnv('S3_PROTOCOL_ACCESS_KEY_ID'),
     s3ProtocolAccessKeySecret: getOptionalConfigFromEnv('S3_PROTOCOL_ACCESS_KEY_SECRET'),
+    s3ProtocolNonCanonicalHostHeader: getOptionalConfigFromEnv(
+      'S3_PROTOCOL_NON_CANONICAL_HOST_HEADER'
+    ),
     // Storage
     storageBackendType: getOptionalConfigFromEnv('STORAGE_BACKEND') as StorageBackendType,
 

src/http/plugins/log-request.ts

@@ -52,7 +52,12 @@ export const logRequest = (options: RequestLoggerOptions) =>
       }
 
       const rMeth = req.method
-      const rUrl = redactQueryParamFromRequest(req, ['token'])
+      const rUrl = redactQueryParamFromRequest(req, [
+        'token',
+        'X-Amz-Credential',
+        'X-Amz-Signature',
+        'X-Amz-Security-Token',
+      ])
       const uAgent = req.headers['user-agent']
       const rId = req.id
       const cIP = req.ip
@@ -78,7 +83,12 @@ export const logRequest = (options: RequestLoggerOptions) =>
       }
 
       const rMeth = req.method
-      const rUrl = redactQueryParamFromRequest(req, ['token'])
+      const rUrl = redactQueryParamFromRequest(req, [
+        'token',
+        'X-Amz-Credential',
+        'X-Amz-Signature',
+        'X-Amz-Security-Token',
+      ])
       const uAgent = req.headers['user-agent']
       const rId = req.id
       const cIP = req.ip

src/http/plugins/signature-v4.ts

@@ -18,25 +18,22 @@ const {
   s3ProtocolEnforceRegion,
   s3ProtocolAccessKeyId,
   s3ProtocolAccessKeySecret,
+  s3ProtocolNonCanonicalHostHeader,
 } = getConfig()
 
-export const signatureV4 = fastifyPlugin(async function (fastify: FastifyInstance) {
-  fastify.addHook('preHandler', async (request: FastifyRequest) => {
-    if (typeof request.headers.authorization !== 'string') {
-      throw ERRORS.AccessDenied('Missing authorization header')
-    }
+type AWSRequest = FastifyRequest<{ Querystring: { 'X-Amz-Credential'?: string } }>
 
-    const clientCredentials = SignatureV4.parseAuthorizationHeader(request.headers.authorization)
+export const signatureV4 = fastifyPlugin(async function (fastify: FastifyInstance) {
+  fastify.addHook('preHandler', async (request: AWSRequest) => {
+    const clientSignature = extractSignature(request)
 
-    const sessionToken = request.headers['x-amz-security-token'] as string | undefined
+    const sessionToken = clientSignature.sessionToken
 
     const {
       signature: signatureV4,
       claims,
       token,
-    } = await createSignature(request.tenantId, clientCredentials, {
-      sessionToken: sessionToken,
-    })
+    } = await createServerSignature(request.tenantId, clientSignature)
 
     const isVerified = signatureV4.verify({
       url: request.url,
@@ -45,9 +42,7 @@ export const signatureV4 = fastifyPlugin(async function (fastify: FastifyInstanc
       method: request.method,
       query: request.query as Record<string, string>,
       prefix: s3ProtocolPrefix,
-      credentials: clientCredentials.credentials,
-      signature: clientCredentials.signature,
-      signedHeaders: clientCredentials.signedHeaders,
+      clientSignature: clientSignature,
     })
 
     if (!isVerified && !sessionToken) {
@@ -94,15 +89,23 @@ export const signatureV4 = fastifyPlugin(async function (fastify: FastifyInstanc
   })
 })
 
-async function createSignature(
-  tenantId: string,
-  clientSignature: ClientSignature,
-  session?: { sessionToken?: string }
-) {
+function extractSignature(req: AWSRequest) {
+  if (typeof req.headers.authorization === 'string') {
+    return SignatureV4.parseAuthorizationHeader(req.headers)
+  }
+
+  if (typeof req.query['X-Amz-Credential'] === 'string') {
+    return SignatureV4.parseQuerySignature(req.query)
+  }
+
+  throw ERRORS.AccessDenied('Missing signature')
+}
+
+async function createServerSignature(tenantId: string, clientSignature: ClientSignature) {
   const awsRegion = storageS3Region
   const awsService = 's3'
 
-  if (session?.sessionToken) {
+  if (clientSignature?.sessionToken) {
     const tenantAnonKey = isMultitenant ? (await getTenantConfig(tenantId)).anonKey : anonKey
 
     if (!tenantAnonKey) {
@@ -112,6 +115,7 @@ async function createSignature(
     const signature = new SignatureV4({
       enforceRegion: s3ProtocolEnforceRegion,
       allowForwardedHeader: s3ProtocolAllowForwardedHeader,
+      nonCanonicalForwardedHost: s3ProtocolNonCanonicalHostHeader,
       credentials: {
         accessKey: tenantId,
         secretKey: tenantAnonKey,
@@ -120,7 +124,7 @@ async function createSignature(
       },
     })
 
-    return { signature, claims: undefined, token: session.sessionToken }
+    return { signature, claims: undefined, token: clientSignature.sessionToken }
   }
 
   if (isMultitenant) {
@@ -132,6 +136,7 @@ async function createSignature(
     const signature = new SignatureV4({
       enforceRegion: s3ProtocolEnforceRegion,
       allowForwardedHeader: s3ProtocolAllowForwardedHeader,
+      nonCanonicalForwardedHost: s3ProtocolNonCanonicalHostHeader,
       credentials: {
         accessKey: credential.accessKey,
         secretKey: credential.secretKey,
@@ -152,6 +157,7 @@ async function createSignature(
   const signature = new SignatureV4({
     enforceRegion: s3ProtocolEnforceRegion,
     allowForwardedHeader: s3ProtocolAllowForwardedHeader,
+    nonCanonicalForwardedHost: s3ProtocolNonCanonicalHostHeader,
     credentials: {
       accessKey: s3ProtocolAccessKeyId,
       secretKey: s3ProtocolAccessKeySecret,

src/monitoring/logger.ts

@@ -23,7 +23,12 @@ export const logger = pino({
         region,
         traceId: request.id,
         method: request.method,
-        url: redactQueryParamFromRequest(request, ['token']),
+        url: redactQueryParamFromRequest(request, [
+          'token',
+          'X-Amz-Credential',
+          'X-Amz-Signature',
+          'X-Amz-Security-Token',
+        ]),
         headers: whitelistHeaders(request.headers),
         hostname: request.hostname,
         remoteAddress: request.ip,

src/storage/errors.ts

@@ -27,6 +27,7 @@ export enum ErrorCode {
   BucketAlreadyExists = 'BucketAlreadyExists',
   DatabaseTimeout = 'DatabaseTimeout',
   InvalidSignature = 'InvalidSignature',
+  ExpiredToken = 'ExpiredToken',
   SignatureDoesNotMatch = 'SignatureDoesNotMatch',
   AccessDenied = 'AccessDenied',
   ResourceLocked = 'ResourceLocked',
@@ -145,9 +146,9 @@ export const ERRORS = {
 
   ExpiredSignature: (e?: Error) =>
     new StorageBackendError({
-      code: ErrorCode.InvalidSignature,
+      code: ErrorCode.ExpiredToken,
       httpStatusCode: 400,
-      message: 'Expired signature',
+      message: 'The provided token has expired.',
       originalError: e,
     }),