Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ETag acceptance should be undone #222

Open
fiendish opened this issue Jun 20, 2019 · 0 comments
Open

ETag acceptance should be undone #222

fiendish opened this issue Jun 20, 2019 · 0 comments

Comments

@fiendish
Copy link

I believe that indexd should not accept ETags and that #82 should be reverted on the premise that it's a real footgun.

ETags are not defined to be content-based hashes. Amazon S3's specific generation of them changes depending on how the file is uploaded. Importantly, a lot of people aren't aware of that and will see "etag" in the accepted types and think it's ok to use.

Also the validation format set in that PR only applies specifically to Amazon S3's arbitrary use. The RFC for ETag defines it as just an opaque string ( https://tools.ietf.org/html/rfc7232#section-2.3 ).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant