Skip to content

Fix Sigv4a-signed requests to endpoints with non-standard ports. #2725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 20, 2021

Conversation

millems
Copy link
Contributor

@millems millems commented Sep 20, 2021

The signed host header must match the host header sent on the wire. HTTP clients append the port to the host header if the port is non-standard for the protocol being used. The current Sigv4a signer only adds the host, not the port, to the host header. This means that endpoints with non-standard ports for the protocol (e.g. an HTTPS service on port 8443) would get a signature validation failure, because the HTTP client will change the host header.

The Sigv4 signer handles this by adding the host header and port before calculating the signature. This PR adds that same logic to the Sigv4a signer.

@millems millems merged commit 27ffdf3 into master Sep 20, 2021
@millems millems deleted the millem/sigv4a-sign-non-standard-ports branch September 20, 2021 20:19
@sonarqubecloud
Copy link

SonarCloud Quality Gate failed.    Quality Gate failed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 1 Code Smell

0.0% 0.0% Coverage
0.0% 0.0% Duplication

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants