Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add more tests for keys with escaped characters #142

Closed
wants to merge 1 commit into from

Conversation

mosiac1
Copy link
Contributor

@mosiac1 mosiac1 commented Aug 9, 2024

Tests are currently failing.

From the SigV4 spec, the path included in the Canonical Request string should have its segments URI encoded.

Both the Java AWS SDK and the AWS CLI will encode the path before sending the request. For example, for the key a=1 in bucket foo the request path would be /foo/a%3D1. This is both the path used in the Canonical Request (for SigV4) and the path of the actual HTTP request.

Playing around with modifying the HTTP path of signed requests I found that Ceph S3 will consider the signature valid even if the path is not encoded. For the example above, Ceph treats /foo/a%3D1 and /foo/a=1 as equivalent.

I think aws-proxy should behave the same, decoding the path once and re-encoding when computing the Canonical Request strings.

Looks like Jetty doesn't do this by default, which does make sense as most reserved URI characters are allows in paths.

@cla-bot cla-bot bot added the cla-signed label Aug 9, 2024
@mosiac1
Copy link
Contributor Author

mosiac1 commented Aug 20, 2024

Closing, this PR was for documentation purposes, I am not sure we should support this encoding/decoding behaviour as a proxy.

@mosiac1 mosiac1 closed this Aug 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

1 participant