tsibelman / aws-signer-v4-dot-net

Sign HttpRequestMessage using AWS Signature v4 using request information and credentials.
Apache License 2.0
72 stars 27 forks source link

Suggestion for dealing with spaces in url #8

Closed jwiater closed 5 years ago

jwiater commented 5 years ago

Hi

I found another thing If there is a space in the url itself, not just the query string we have the same problem.

If the url contains space, normally it is encoded to + or %20 But then it is encoded again with the % to %25 so the %20 becomes %2520

AWS complains about that – the message that “the canonical string should be …”

The solution is to Escape also the URL, but one must be careful since it wants to encode also the / characters:

So:

In the place where you have:

canonical_request.Append( request.RequestUri.AbsolutePath + "\n" );

use this:

string sanitizedUrl = SanitizeUrl( request.RequestUri.AbsolutePath ); canonical_request.Append( sanitizedUrl + "\n" );

and add SanitizeUrl method:

private string SanitizeUrl( string absolutePath ) { StringBuilder sb = new StringBuilder(); string[] segments = absolutePath.Split( new char[] { '/' }, StringSplitOptions.RemoveEmptyEntries );

foreach( var s in segments )
{
    sb.Append( "/" );
    sb.Append( Uri.EscapeDataString( s ) );
}

return sb.ToString();

}

Thank you

tsibelman commented 5 years ago

Can you give me an example url

jwiater commented 5 years ago

imagine passing parameters in url path, not query string:

htttp://someservice/someGetRequest/resourceType/nice%20things

Something like that would fail

jwiater commented 5 years ago

image

Example of API Gateway service using path parameters

tsibelman commented 5 years ago

I made a new version with this change.