colinmarc opened a new issue, #771: URL: https://github.com/apache/opendal-reqsign/issues/771
Hi, thanks for the great crate. We use `reqsign` to presign AWS urls for consumption elsewhere. We use `DefaultCredentialProvider` and, in production, generally `IDMSv2`. With this combination, it's theoretically possible that the generated IDMS credentials expire before the signed URL, rendering the signed URL useless. That's because a signed URL can only last as long as the credentials that created it, regardless of expiry. This is a bit tricky or I would've opened a PR already. As I see it the simplest change is to `SigningCredential::is_valid` https://github.com/apache/opendal-reqsign/blob/5c526bab3345051790e867bc846a40acc93c165c/core/src/api.rs#L24-L28 If we change it to `is_valid(at: Timestamp)`, then we can determine whether we need to refresh the credential before signing the request. However, it's a public trait, therefore a breaking change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
