pjfanning commented on PR #1971: URL: https://github.com/apache/pekko-connectors/pull/1971#issuecomment-5909928827
Could you explain the problem this fixes in more detail? Here's my understanding from the code; please correct it if it's wrong. The request path is sent in one form and signed in another: - **Wire:** `HttpRequests.rawRequestUri` only rewrites `+` to `%2B`, so characters such as `! $ & ' ( ) * , ; = : @` are sent literally. A key like `a=b.txt` goes out as `/a=b.txt`. - **Signed:** `CanonicalRequest.pathEncode` percent-encodes those characters, so the canonical path is `/a%3Db.txt`. AWS re-encodes the path it receives, so the two match. I assume OBS and COS sign the path as received, or re-encode with a different set of characters, so they reject the request with 403 `SignatureDoesNotMatch`. This PR lets users remove characters from the encoded set so the signed path matches what the server computes. Could you confirm: 1. Does the 403 only happen for object keys containing some of these characters? If plain keys fail too, the cause is probably something else. 2. What value of `reserved-characters` works for Huawei OBS, and what works for Tencent COS? Ideally with a link to each vendor's signing docs. This should also go in the docs. 3. Did you try encoding these characters on the wire as well, the way `+` already is? If the sent and signed paths were identical, we might not need a setting at all, as long as those servers decode the path before signing it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
