Misaligned headers in 2.5.0, POSTS and PUTS fail due to missing content_hash in canonical string - signature mismatch

mgomes / api_auth

HMAC authentication for Rails and HTTP Clients

MIT License

480 stars 147 forks source link

Misaligned headers in 2.5.0, POSTS and PUTS fail due to missing content_hash in canonical string - signature mismatch #201

Closed shaheenery closed 2 years ago

shaheenery commented 2 years ago

If a dev is currently using api-auth 2.5.0 for client and server apps with client request Net:HTTP and server request ActionDispatch::Request, then a PUT or POST can never succeed.

This issue is already fixed by https://github.com/mgomes/api_auth/commit/7a3a86510edaeb1312aed5971caefd0cb795657c

But there is no 2.5.1 with this fix. I can fix my problem by specifying this commit in my Gemfile, but any new users of this gem are going to be having a horrible experience.

fwininger commented 2 years ago

@kjg @mgomes can you release a new version from master, please !

mgomes commented 2 years ago

Done! v2.5.1 has just gone out. cc/ @taylorthurlow

taylorthurlow commented 2 years ago

@mgomes Looks like this is working great for Rails requests but I still have this issue because the RequestDriver used for my request is RackRequest, not ActionControllerRequest. This seems like it goes for virtually all of the other RequestDriver modules - am I missing something?

If I'm not, then we should probably either pull out the list of possible authorization header names into ApiAuth::Helpers and change each RequestDriver to pull the first matching header however they see fit.