search

opensearch-project / opensearch-hadoop

Apache License 2.0
29 stars 22 forks source link

Fix AWS SigV4 incorrectly signing POST requests with empty bodies #443

Closed Xtansia closed 2 months ago

Xtansia commented 2 months ago

Description

When the AWS SigV4 signer encounters a POST request with a null body, it uses the query parameters as the body content for the purposes of signing. This results in a mismatch of canonical request strings between the client and the service, resulting in a failed request for scroll requests:

Screenshot 2024-04-15 at 5 11 10 PM

The left is what the signer calculated, the right is what the service said it was expecting, notice the query params are nowhere to be seen as they've been treated as body content, and as such the body SHA256 is different as well and not the expected SHA256 of an empty string e3b0c....

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check here.

harshavamsi commented 2 months ago

@Xtansia perhaps we release a new minor version?

Xtansia commented 2 months ago

@harshavamsi Have made a PR prepping for a release: #449