support for Amazon Signature v4, derived key

chilts / awssum

(deprecated: use aws-sdk) Node.js modules for talking to lots of Web Service APIs.

Other

461 stars 57 forks source link

support for Amazon Signature v4, derived key #52

Closed jokeyrhyme closed 12 years ago

jokeyrhyme commented 12 years ago

Looks like there's a newer version of the signing process: http://docs.amazonwebservices.com/general/latest/gr/signature-version-4.html

v4 is more secure than v2 by:

limiting requests to a credential scope
deriving a temporary token instead of using your secret key

Other than this, it seems to be very similar in usage to v2.

Any plans to use this type of signature?

chilts commented 12 years ago

Hi Ron,

For which service are you talking about? There is already a v4 signature being used for CloudSearch and StorageGateway.

https://github.com/appsattic/node-awssum/blob/master/lib/amazon/aws-signature-v4.js

If there are other services which use or can use v4, I can change them but I know of no others. Let me know the links to the docs.

Cheers, Andy

jokeyrhyme commented 12 years ago

Sorry, my bad. You're probably correct that only those products support v4. I took a quick look at SQS and it seemed to be v1 (deprecated) or v2 only.

I made the ticket after reading the table in README.md. Sorry for jumping the gun a bit, I probably should have dug deeper first. Good to know you're already on top of v4.

Cheers!

chilts commented 12 years ago

No worries. :)