MD5 is not checked if it's empty

[caseyvu]

At https://github.com/mgomes/api_auth/blob/master/lib/api_auth/headers.rb#L77

def md5_mismatch?
    if @request.content_md5.empty?
        false
    else
        @request.md5_mismatch?
    end
end

So the md5 is not checked if the header "Content-MD5" is empty. Which mean I can replace the payload, remove the Content-MD5 and get passed the check.

[mgomes]

The content-md5 header is indeed optional. However, if a client adds one, it can't be replaced as you suggested. You could remove it from the canonical string, but the Authorization header has already been hashed with the private key and includes the md5 signature.

[caseyvu]

silly me! thanks for the clarification