[
https://issues.apache.org/jira/browse/HDDS-16251?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated HDDS-16251:
----------------------------------
Labels: pull-request-available (was: )
> S3 Gateway rejects PutObject when empty Content-Type is included in
> SignedHeaders
> ---------------------------------------------------------------------------------
>
> Key: HDDS-16251
> URL: https://issues.apache.org/jira/browse/HDDS-16251
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Shuo Huang
> Assignee: Shuo Huang
> Priority: Major
> Labels: pull-request-available
>
> h3. Problem
> The ceph/s3-tests case {{test_object_create_bad_contenttype_empty}} sends a
> PutObject request with an explicitly empty Content-Type:
> {code:python}
> client.put_object(
> Bucket=bucket_name,
> Key=key_name,
> Body="bar",
> ContentType="")
> {code}
> Botocore includes {{content-type}} in {{SignedHeaders}}, even though its
> value is empty.
> Ozone returns HTTP 403 with:
> {code}
> InvalidRequest: Error creating s3 auth info. The request may not be signed
> using AWS V4 signing algorithm, or might be invalid
> {code}
> The compatibility test expects the PutObject request to succeed.
> h3. Root cause
> {{EmptyContentTypeFilter}} removes an empty Content-Type header before
> signature processing.
> However, {{content-type}} is still present in the request's
> {{SignedHeaders}}. When {{StringToSignProducer}} reconstructs the canonical
> request, it cannot find the header and rejects the request with:
> {code}
> Header content-type not present in request but requested to be signed.
> {code}
> h3. Reproduction
> Run against a packaged Ozone cluster:
> {code:bash}
> S3TEST_CONF=<path-to-s3tests.conf> python -m pytest -v \
> s3tests/functional/test_headers.py::test_object_create_bad_contenttype_empty
> {code}
> Result:
> {code}
> FAILED
> botocore.errorfactory.InvalidRequest:
> An error occurred (InvalidRequest) when calling the PutObject operation:
> Error creating s3 auth info.
> {code}
> h3. Related work
> HDDS-4856 added {{EmptyContentTypeFilter}} to support requests with an empty
> Content-Type header. In the request reported there, {{content-type}} was not
> included in {{SignedHeaders}}.
> The current case is different because the empty Content-Type is explicitly
> signed. Removing it prevents Ozone from reconstructing the canonical request.
> h3. References
> * [Nightly compatibility
> failure|https://ozone.s3.peterxcli.dev/?run=2026-08-22T03-14-42Z&caseSuite=s3_tests&test=test_object_create_bad_contenttype_empty#latest-run-section]
> * [ceph/s3-tests test
> case|https://github.com/ceph/s3-tests/blob/fb8b73092bb1dd8db829f1205a9e52e73bf9a232/s3tests/functional/test_headers.py#L239-L244]
> * [HDDS-4856|https://issues.apache.org/jira/browse/HDDS-4856]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
