search

okigan / awscurl

curl-like access to AWS resources with AWS Signature Version 4 request signing.
MIT License
737 stars 91 forks source link

Host header only checked if provided as lowercase #88

Closed elpy1 closed 4 years ago

elpy1 commented 4 years ago

When building the signing request, we are only checking for 'host' -> https://github.com/okigan/awscurl/blob/master/awscurl/awscurl.py#L174

If, for example, I specify --header 'Host: www.google.com', this is completely disregarded, causing many headaches as to why I couldn't auth! Even though HTTP headers are to be considered case-insensitive as per RFC it is known that some servers require the 'host' header have a capitalised first letter.

This change ensures we store the header type as a lower case string.

okigan commented 4 years ago

There was a similar thread I think - please see https://github.com/okigan/awscurl/pull/72/files - what do you think about this approach?

On May 4, 2020, at 10:14 PM, L1 notifications@github.com wrote:

 When building the signing request, we are only checking for 'host' -> https://github.com/okigan/awscurl/blob/master/awscurl/awscurl.py#L174

If, for example, I specify --header 'Host: www.google.com', this is completely disregarded, causing many headaches as to why I couldn't auth! Even though HTTP headers are to be considered case-insensitive as per RFC it is known that some servers require the 'host' header have a capitalised first letter.

This change ensures we store the header type as a lower case string.

You can view, comment on, or merge this pull request online at:

https://github.com/okigan/awscurl/pull/88

Commit Summary

Host header only checked if provided as lowercase File Changes

M awscurl/awscurl.py (2) Patch Links:

https://github.com/okigan/awscurl/pull/88.patch https://github.com/okigan/awscurl/pull/88.diff — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

elpy1 commented 4 years ago

sorry, I should have checked first.

Looks fine to me I guess. Replacing args.header with something like [h.lower() for h in args.headers] (https://github.com/okigan/awscurl/blob/a6f23e34a9b80f6d6301b182908db63238366ff9/awscurl/awscurl.py#L463) would probably achieve the same result if you only need to check/compare one or two headers.

Either way, thanks for the prompt response! All the best.