Skip to content

Commit c0b5ee3

Browse files
authored
Exclude transfer-encoding header from sigv4(a) signing (#3991)
Add changelog ## Motivation and Context <!--- Why is this change required? What problem does it solve? --> <!--- If it fixes an open issue, please link to the issue here --> Exclude `transfer-encoding` header from sigv4(a) signing. It is a hop by hop header and can be erased or modified by a proxy (in our particular case Cloudfront) ## Description <!--- Describe your changes in detail --> ## Testing <!--- Please describe in detail how you tested your changes --> <!--- Include details of your testing environment, and the tests you ran to --> <!--- see how your change affects other areas of the code, etc. --> Updated the existing tests for excluded headers. ## Checklist <!--- If a checkbox below is not applicable, then please DELETE it rather than leaving it unchecked --> - [x] For changes to the AWS SDK, generated SDK code, or SDK runtime crates, I have created a changelog entry Markdown file in the `.changelog` directory, specifying "aws-sdk-rust" in the `applies_to` key. ---- _By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice._
1 parent 0a63d5b commit c0b5ee3

File tree

5 files changed

+19
-5
lines changed

5 files changed

+19
-5
lines changed
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
applies_to: ["aws-sdk-rust"]
3+
authors: ["landonxjames"]
4+
references: ["smithy-rs#3991"]
5+
breaking: false
6+
new_feature: false
7+
bug_fix: true
8+
---
9+
10+
Exclude `transfer-encoding` header from sigv4(a) signing since it is a hop by hop header that can be modified or removed by a proxy.

aws/rust-runtime/Cargo.lock

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

aws/rust-runtime/aws-sigv4/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "aws-sigv4"
3-
version = "1.2.7"
3+
version = "1.2.8"
44
authors = ["AWS Rust SDK Team <aws-sdk-rust@amazon.com>", "David Barsky <me@davidbarsky.com>"]
55
description = "SigV4 signer for HTTP requests and Event Stream messages."
66
edition = "2021"

aws/rust-runtime/aws-sigv4/src/http_request/canonical_request.rs

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -877,7 +877,7 @@ mod tests {
877877
assert_eq!(creq.values.signed_headers().as_str(), "host;x-amz-date");
878878
}
879879

880-
// It should exclude authorization, user-agent, x-amzn-trace-id headers from presigning
880+
// It should exclude authorization, user-agent, x-amzn-trace-id, and transfer-encoding headers from presigning
881881
#[test]
882882
fn non_presigning_header_exclusion() {
883883
let request = http0::Request::builder()
@@ -888,6 +888,7 @@ mod tests {
888888
.header("user-agent", "test-user-agent")
889889
.header("x-amzn-trace-id", "test-trace-id")
890890
.header("x-amz-user-agent", "test-user-agent")
891+
.header("transfer-encoding", "chunked")
891892
.body("")
892893
.unwrap()
893894
.into();
@@ -909,7 +910,7 @@ mod tests {
909910
);
910911
}
911912

912-
// It should exclude authorization, user-agent, x-amz-user-agent, x-amzn-trace-id headers from presigning
913+
// It should exclude authorization, user-agent, x-amz-user-agent, x-amzn-trace-id, and transfer-encoding headers from presigning
913914
#[test]
914915
fn presigning_header_exclusion() {
915916
let request = http0::Request::builder()
@@ -920,6 +921,7 @@ mod tests {
920921
.header("user-agent", "test-user-agent")
921922
.header("x-amzn-trace-id", "test-trace-id")
922923
.header("x-amz-user-agent", "test-user-agent")
924+
.header("transfer-encoding", "chunked")
923925
.body("")
924926
.unwrap()
925927
.into();

aws/rust-runtime/aws-sigv4/src/http_request/settings.rs

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* SPDX-License-Identifier: Apache-2.0
44
*/
55

6-
use http0::header::{AUTHORIZATION, USER_AGENT};
6+
use http0::header::{AUTHORIZATION, TRANSFER_ENCODING, USER_AGENT};
77
use std::borrow::Cow;
88
use std::time::Duration;
99

@@ -126,6 +126,8 @@ impl Default for SigningSettings {
126126
Cow::Borrowed(USER_AGENT.as_str()),
127127
// Changes based on the request from the client
128128
Cow::Borrowed(HEADER_NAME_X_RAY_TRACE_ID),
129+
// Hop by hop header, can be erased by Cloudfront
130+
Cow::Borrowed(TRANSFER_ENCODING.as_str()),
129131
]
130132
.to_vec(),
131133
);

0 commit comments

Comments
 (0)