Shuo Huang created HDDS-16251:
---------------------------------
Summary: S3 Gateway rejects PutObject when empty Content-Type is
included in SignedHeaders
Key: HDDS-16251
URL: https://issues.apache.org/jira/browse/HDDS-16251
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Shuo Huang
Assignee: Shuo Huang
h3. Problem
The ceph/s3-tests case {{test_object_create_bad_contenttype_empty}} sends a
PutObject request with an explicitly empty Content-Type:
{code:python}
client.put_object(
Bucket=bucket_name,
Key=key_name,
Body="bar",
ContentType="")
{code}
Botocore includes {{content-type}} in {{SignedHeaders}}, even though its value
is empty.
Ozone returns HTTP 403 with:
{code}
InvalidRequest: Error creating s3 auth info. The request may not be signed
using AWS V4 signing algorithm, or might be invalid
{code}
The compatibility test expects the PutObject request to succeed.
h3. Root cause
{{EmptyContentTypeFilter}} removes an empty Content-Type header before
signature processing.
However, {{content-type}} is still present in the request's {{SignedHeaders}}.
When {{StringToSignProducer}} reconstructs the canonical request, it cannot
find the header and rejects the request with:
{code}
Header content-type not present in request but requested to be signed.
{code}
h3. Reproduction
Run against a packaged Ozone cluster:
{code:bash}
S3TEST_CONF=<path-to-s3tests.conf> python -m pytest -v \
s3tests/functional/test_headers.py::test_object_create_bad_contenttype_empty
{code}
Result:
{code}
FAILED
botocore.errorfactory.InvalidRequest:
An error occurred (InvalidRequest) when calling the PutObject operation:
Error creating s3 auth info.
{code}
h3. Related work
HDDS-4856 added {{EmptyContentTypeFilter}} to support requests with an empty
Content-Type header. In the request reported there, {{content-type}} was not
included in {{SignedHeaders}}.
The current case is different because the empty Content-Type is explicitly
signed. Removing it prevents Ozone from reconstructing the canonical request.
h3. References
* [Nightly compatibility
failure|https://ozone.s3.peterxcli.dev/?run=2026-08-22T03-14-42Z&caseSuite=s3_tests&test=test_object_create_bad_contenttype_empty#latest-run-section]
* [ceph/s3-tests test
case|https://github.com/ceph/s3-tests/blob/fb8b73092bb1dd8db829f1205a9e52e73bf9a232/s3tests/functional/test_headers.py#L239-L244]
* [HDDS-4856|https://issues.apache.org/jira/browse/HDDS-4856]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
