Closed vagaerg closed 1 month ago
Note: this behaviour where UNSIGNED-PAYLOAD
requests fail to validate in the proxy was observed when using a Python boto3-generated unsigned upload request: https://github.com/vagaerg/aws-proxy-testing/blob/9ba255bb047cfd115a936a59ed7d6ebe168d3284/test_s3.py#L21-L27
The proxy disables "payload signing" if the content hash equals
UNSIGNED-PAYLOAD
: https://github.com/trinodb/aws-proxy/blob/a00969b9025a48d679425dd7065c08c9ebc17afa/trino-aws-proxy/src/main/java/io/trino/aws/proxy/server/signing/Signer.java#L136-L138That method's Javadoc states:
However, this appears to be messing with
UNSIGNED-PAYLOAD
requests as it does not appear to be designed for that use case. From the docs I imagine disabling payload signing may be resulting inUNSIGNED-PAYLOAD
not being added to the canonical request, thus making signature verification fail.In any case, I believe we can safely always enable payload signing, since we never recompute the hash of the payload and instead reuse the value of
X-amz-content-sha256
: https://github.com/trinodb/aws-proxy/blob/a00969b9025a48d679425dd7065c08c9ebc17afa/trino-aws-proxy/src/main/java/io/trino/aws/proxy/server/signing/Signer.java#L140-L146UNSIGNED-PAYLOAD
, so there is no content to be read or hash to be computed