Huang Kuan Hao created HDDS-15851:
-------------------------------------
Summary: Expired or out-of-range pre-signed URLs return 400
MalformedHeader instead of 403
Key: HDDS-15851
URL: https://issues.apache.org/jira/browse/HDDS-15851
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Huang Kuan Hao
Assignee: Huang Kuan Hao
Ceph s3-tests fail because expired or out-of-range pre-signed URLs return HTTP
400
instead of 403.
Failing Ceph s3-tests (4):
- test_object_raw_get_x_amz_expires_out_max_range
- test_object_raw_get_x_amz_expires_out_positive_range
- test_object_raw_get_x_amz_expires_out_range_zero
- test_object_raw_put_authenticated_expired
Each sends a pre-signed URL whose \{{X-Amz-Expires}} is outside [1, 604800]
(e.g.
ExpiresIn=609901) or an already-expired pre-signed request.
- Expected (AWS): HTTP 403.
- Ozone: HTTP 400 (MalformedHeader).
Root cause:
{\{AuthorizationV4QueryParser.validateDateAndExpires()}} throws
{\{MalformedResourceException}} for both an expired URL ("Pre-signed S3 url is
expired") and an out-of-range duration ("Invalid expiry duration"). The single
catch in \{{AWSSignatureProcessor}} maps every \{{MalformedResourceException}}
to
{\{S3ErrorTable.MALFORMED_HEADER}} (HTTP 400). AWS rejects an expired/invalid-
duration pre-signed request with HTTP 403, distinct from a genuinely malformed
header (400); these expiry cases should surface as 403.
Ref: [https://ozone.s3.peterxcli.dev/]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
