Closed chreekat closed 6 months ago
I have a repro here: https://github.com/chreekat/r2-repro/ . It is based on the package I was originally working on, hence the slightly funky stack.yaml.
I adapted it to work with amazonka-2.0, but now I seem to have hit a stack bug or something, so I need a bit of time to push that...
Oh, and I can provide credentials to a test R2 bucket via PM if that helps.
I updated the repro, but see https://github.com/commercialhaskell/stack/issues/5473#issuecomment-1892110831 for why it's not so easy to swap between the repro and the patched test case.
The AWS SigV4 docs say:
For the purpose of calculating an authorization signature, only the
host
and anyx-amz-*
headers are required; however, in order to prevent data tampering, you should consider including all the headers in the signature calculation.
So I don't think there's anything stopping us from filtering out an expect:
header. The fact that botocore
blacklists it makes me even more confident that it's safe for us to drop it:
In that case I've opened #977 with my little patch.
I am unable to send a PutObject to R2, Cloudflare's object storage. I get a
SignatureDoesNotMatch
error.I eventually figured out a workaround: remove
expect
from the list of normalised headers.While I consider this a bug in R2, it looks like the aws utility doesn't include
expect
in its signature, either. I don't know the security implications for removing it, so I'm not gonna open a PR yet. Any thoughts?This is the workaround for 2.0:
And similarly for 1.6.1: