Gargi-jais11 commented on PR #10539: URL: https://github.com/apache/ozone/pull/10539#issuecomment-5021974206
@ivandika3 and @hevinhsu sorry for very late reply. You're both right — there is no AWS documentation that singles out `x-amz-acl` as a special exemption from SignedHeaders. The AWS SigV4 spec ([docs.aws.amazon.com/general/latest/gr/sigv4_signing.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html)) is clear: "You must include the host header (HTTP/1.1) or the :authority header (HTTP/2), and any x-amz-* headers in the signature. You can optionally include other standard headers in the signature, such as content-type."* That rule applies to Authorization header authentication (regular signed requests). For presigned (query-parameter) authentication, the signer commits to only the headers listed in `X-Amz-SignedHeaders` (typically just host). The server MUST NOT reject the request if the client adds any extra headers at request time that weren't in the presigned URL. The real bug here is that `validateCanonicalHeaders` already receives an **unsignedPayload boolean parameter** (which is true for all presigned URL requests since signPayload=false in `AuthorizationV4QueryParser`), but that parameter is never used in the method body. The `x-amz-*` check runs unconditionally for all request types. The correct fix is not to add per-header exceptions (x-amz-content-sha256, x-amz-acl, ...etc.), but to skip the entire x-amz-* check when `unsignedPayload=true` What u both think about this? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
