rust-s3: Signature mismatch

Describe the bug

When using bucket.presign_get("/some/path/file.txt"), I get a signature mismatch with some DigitalOcean spaces. The generated presigned URL always contains the slashes in the path encoded as %2F, and sometimes this is okay (changing them to /es does not break the presigned URL), but sometimes I get a signature mismatch (changing them to /es then fixes the presigned URL). I’m not sure whether percent-encoding the path before signing would help, or just make it fail with other servers. Another approach would be to never percent-encode slashes, which all servers seem to support according to the analysis in #133.

To Reproduce

I’ve uploaded an empty file to the S3 space that has this issue. The following presigned URL is valid for 7 days:

https://lumeo-api.sfo2.digitaloceanspaces.com/s3-signing-issue/foo.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=LGYCZBSFXVLMQBZMXVBB%2F20201201%2Fsfo2%2Fs3%2Faws4_request&X-Amz-Date=20201201T114438Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=9ee914bd679aed482b05849bf615a9f8bb39f13ceefd0618c0b014647b78e0db

Here is the same URL, with the / before foo.txt encoded as %2F. You get a signature mismatch when requesting it:

https://lumeo-api.sfo2.digitaloceanspaces.com/s3-signing-issue%2Ffoo.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=LGYCZBSFXVLMQBZMXVBB%2F20201201%2Fsfo2%2Fs3%2Faws4_request&X-Amz-Date=20201201T114438Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=9ee914bd679aed482b05849bf615a9f8bb39f13ceefd0618c0b014647b78e0db

Expected behavior

The URL generated by .presign_get should work…

Environment

  • Rust version: 1.48.0
  • lib version 0.26.3

About this issue

  • Original URL
  • State: closed
  • Created 4 years ago
  • Comments: 20 (20 by maintainers)

Most upvoted comments

It would be ideal to remove it, let me come up with some tests for that, if we can prove its not doing anything useful I’ll be happy to take it out!

I mentioned #133 above, maybe you mean that? I ended up applying a very similar workaround for now.