[
https://issues.apache.org/jira/browse/HDDS-15851?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated HDDS-15851:
----------------------------------
Labels: pull-request-available (was: )
> Expired or out-of-range pre-signed URLs return 400 MalformedHeader instead of
> 403
> ---------------------------------------------------------------------------------
>
> Key: HDDS-15851
> URL: https://issues.apache.org/jira/browse/HDDS-15851
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Huang Kuan Hao
> Assignee: Huang Kuan Hao
> Priority: Major
> Labels: pull-request-available
>
> Ceph s3-tests fail because expired or out-of-range pre-signed URLs return
> HTTP 400
> instead of 403.
> Failing Ceph s3-tests (4):
> - test_object_raw_get_x_amz_expires_out_max_range
> - test_object_raw_get_x_amz_expires_out_positive_range
> - test_object_raw_get_x_amz_expires_out_range_zero
> - test_object_raw_put_authenticated_expired
> Each sends a pre-signed URL whose \{{X-Amz-Expires}} is outside [1, 604800]
> (e.g.
> ExpiresIn=609901) or an already-expired pre-signed request.
> - Expected (AWS): HTTP 403.
> - Ozone: HTTP 400 (MalformedHeader).
> Root cause:
> {\{AuthorizationV4QueryParser.validateDateAndExpires()}} throws
> {\{MalformedResourceException}} for both an expired URL ("Pre-signed S3 url is
> expired") and an out-of-range duration ("Invalid expiry duration"). The single
> catch in \{{AWSSignatureProcessor}} maps every
> \{{MalformedResourceException}} to
> {\{S3ErrorTable.MALFORMED_HEADER}} (HTTP 400). AWS rejects an expired/invalid-
> duration pre-signed request with HTTP 403, distinct from a genuinely malformed
> header (400); these expiry cases should surface as 403.
> Ref: [https://ozone.s3.peterxcli.dev/]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
