Metadata header not signed error

[mosi-kha]

Describe the bug when i don't pass metadata everything is okay, but when I pass Metadata to tuspy and request to tusd it's can't create multipart upload becase:

[tusd] 2022/07/27 16:51:07 event="RequestIncoming" method="POST" path="" requestId="" 
[tusd] 2022/07/27 16:51:07.762881 event="HookInvocationStart" type="pre-create" id="" 
[tusd] 2022/07/27 16:51:09.617961 event="HookInvocationFinish" type="pre-create" id="" 
[tusd] 2022/07/27 16:51:11 event="ResponseOutgoing" status="500" method="POST" path="" error="s3store: unable to create multipart upload:
AccessDenied: There were headers present in the request which were not signed
        status code: 400, request id: 1705AF045D965B3B, host id: " requestId="" 

To Reproduce Steps to reproduce the behavior:

1. Export AWS configs
2. Run tusd server: tusd --hooks-http http://127.0.0.1:43211/upload/tusd -s3-bucket=tusd -s3-endpoint=https://s3.staging.ir
3. Upload snippet code:

   
   tus_client = TusClient(url=tus_url)
   tus_storage = filestorage.FileStorage("storage_file")
   uploader = tus_client.uploader(
   file_path,
   chunk_size=500000,
   store_url=True,
   url_storage=tus_storage,
   metadata={
       "space_id": "1",
   },
   )
   uploader.upload()

5. See error

[tusd] 2022/07/27 16:59:53.323126 Using 'https://s3.staging.ir/tusd' as S3 endpoint and bucket for storage. [tusd] 2022/07/27 16:59:53.323240 Using 0.00MB as maximum size. [tusd] 2022/07/27 16:59:53.323245 Using 'http://127.0.0.1:8000/upload/tusd' as the endpoint for hooks [tusd] 2022/07/27 16:59:53.323250 Enabled hook events: pre-create, post-create, post-receive, post-terminate, post-finish [tusd] 2022/07/27 16:59:53.323263 Using 0.0.0.0:1080 as address to listen. [tusd] 2022/07/27 16:59:53.323266 Using /files/ as the base path. [tusd] 2022/07/27 16:59:53.323289 Using /metrics as the metrics path. [tusd] 2022/07/27 16:59:53.323331 Supported tus extensions: creation,creation-with-upload,termination,concatenation,creation-defer-length [tusd] 2022/07/27 16:59:53.323432 You can now upload files to: http://0.0.0.0:1080/files/ [tusd] 2022/07/27 17:01:12 event="RequestIncoming" method="POST" path="" requestId="" [tusd] 2022/07/27 17:01:12.095351 event="HookInvocationStart" type="pre-create" id="" [tusd] 2022/07/27 17:01:14.493380 event="HookInvocationFinish" type="pre-create" id="" [tusd] 2022/07/27 17:01:15 event="ResponseOutgoing" status="500" method="POST" path="" error="s3store: unable to create multipart upload: AccessDenied: There were headers present in the request which were not signed status code: 400, request id: 1705AF911E32B420, host id: " requestId=""

**Expected behavior**
create multiple upload parts and go on.

**Setup details**
Please provide following details, if applicable to your situation:
- Operating System: linux
- Used tusd version: 1.9.1
- Used tusd data storage: minio version:2021-02-19T04:38:02Z.
- Used tusd configuration: `tusd --hooks-http http://127.0.0.1:43211/upload/tusd -s3-bucket=tusd -s3-endpoint=https://s3.staging.ir`
- Used tus client library: tuspy 1.0.0

[Acconut]

Does the upload work if you configure tuspy to use the https://tusd.tusdemo.net/files/ endpoint? If yes, it might indicate a problem with your S3-compatible storage.

[mosi-kha]

@Acconut sorry for the wrong data in the setup details, tusd data storage is minio version:2021-02-19T04:38:02Z. yes, it's uploaded on https://tusd.tusdemo.net/files/ and I figured out what is the root problem it's for using _ in a metadata's key, in my example when I remove _ in space_id has been okay. now I don't know if it's an issue about Unicodeing metadata in tusd or minio issue. I tested with another s3 storage compatible(arvanCloud object storage) and this issue happens with SignatureDoesNotMatch error.

[mosi-kha]

can happen from aws-sdk-go? because there was the same issue on another sdk (aws-sdk-net)

[Acconut]

Ok, so to summarize:

• You can upload to https://tusd.tusdemo.net/files/ (which uses AWS S3)
• You cannot upload when tusd uses Minio or ArvanCloud
• The error only occurs when an underscore is present in the metadata key

Could you try uploading to AWS S3 using tusd on your own and see if that works?

For now, this looks to me to be a bug in the Minio storage. I wasn't able to find a concrete issue for the aws-sdk-go, but this issue describes the reason why underscores are problematic: https://github.com/localstack/localstack/issues/459#issuecomment-346756560

I would recommend you to not user underscores in the metadata key for now. In addition, I am wondering if tusd should strip underscores from the metadata key by default now. Any thoughts on this?

[mosi-kha]

Could you try uploading to AWS S3 using tusd on your own and see if that works?

sorry, I don't have AWS S3 account and I can't create it because of my religion! :(

I am wondering if tusd should strip underscores from the metadata key by default now. Any thoughts on this?

can you reproduce this scenario and see the metadata header that tusd send to an S3 server?