astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-10-06 17:55:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): align signed request and policy condition semantics

Browse Source 
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-09-11 16:24:42 +08:00
parent f760046c44
commit 87d8b5967f
8 changed files with 412 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/signature-v4-utils_test.go
+7 -6
View File
@@ -469,15 +469,16 @@ func TestCheckUnsignedHeaders(t *testing.T) {
t.Fatalf("unsigned x-amz-content-sha256 must be exempt: expected %d, got %d", ErrNone, errCode)
}
// X-Amz-Signature-Age is the presigned verifier's own scratch header,
// written after this check. Exempting it keeps verification idempotent when
// the same request object is verified more than once.
// X-Amz-Signature-Age was once a scratch header the presigned verifier wrote
// back and this check exempted. s3:signatureAge is now derived from the
// signed date, so a client that sends the header is sending an ordinary
// unsigned x-amz-* header and must be rejected like any other.
r, err = http.NewRequest(http.MethodPut, "http://play.min.io:9000", nil)
if err != nil {
t.Fatal("Unable to create http.Request :", err)
}
r.Header.Set(xhttp.AmzSignatureAge, "1234")
if errCode = checkUnsignedHeaders(signedHeadersMap, r); errCode != ErrNone {
t.Fatalf("internal x-amz-signature-age must be exempt: expected %d, got %d", ErrNone, errCode)
r.Header.Set("X-Amz-Signature-Age", "1234")
if errCode = checkUnsignedHeaders(signedHeadersMap, r); errCode != ErrUnsignedHeaders {
t.Fatalf("unsigned x-amz-signature-age must be rejected: expected %d, got %d", ErrUnsignedHeaders, errCode)
}
}