Authentication fails if both date and both x-ms-date is specified
- Dominant language
- TypeScript
- Stars
- 2.3k
- Forks
- 393
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 36
Description
### Which service(blob, file, queue, table) does this issue concern?
blob
### Which version of the Azurite was used?
V3
### Where do you get Azurite? (npm, DockerHub, NuGet, Visual Studio Code Extension)
DockerHub
### What's the Node.js version?
### What problem was encountered?
Authentication fails with 403
Auzre documentation mentions that if both "date:" and "x-ms-date:" is specified, one should construct the authentication string with an empty value for the Date header.
However, when my application construct the auth string with empty value for "date" authentication fails. This works with production storage account.
Please see the log for details
My application uses following string
HEAD HTTP/1.1
Host: 127.0.0.1
date: Thu, 10 Mar 2022 21:38:40 GMT
x-ms-date: Thu, 10 Mar 2022 21:38:40 GMT
x-ms-version: 2018-11-09
'HEAD\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:Thu, 10 Mar 2022 21:38:40 GMT\nx-ms-version:2018-11-09\n/devstoreaccount1/devstoreaccount1/mycontainer\nrestype:container'
however, debug log shows that Azurite is using
HEAD\n\n\n\n\n\nThu, 10 Mar 2022 21:38:40 GMT\n\n\n\n\n\nx-ms-date:Thu, 10 Mar 2022 21:38:40 GMT\nx-ms-version:2018-11-09\n/devstoreaccount1/devstoreaccount1/mycontainer\nrestype:container"
### Steps to reproduce the issue?
Set both date and x-ms-date but use only x-ms-date for authentication string.
#####If possible, please provide the debug log using the -d parameter, replacing \ with an appropriate path for your OS, or review the instructions for docker containers:
------------------------------------------------
2022-03-10T21:38:40.973Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobStorageContextMiddleware: RequestMethod=HEAD RequestURL=https://127.0.0.1/devstoreaccount1/mycontainer?restype=container RequestHeaders:{"host":"127.0.0.1","date":"Thu, 10 Mar 2022 21:38:40 GMT","x-ms-date":"Thu, 10 Mar 2022 21:38:40 GMT","x-ms-version":"2018-11-09","authorization":"SharedKey devstoreaccount1:Bq200mrekeSTUw8ai9VBoE0lgxqLHRuArcBTi0z51Cs="} ClientIP=172.17.0.1 Protocol=https HTTPVersion=1.1
2022-03-10T21:38:40.974Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobStorageContextMiddleware: Account=devstoreaccount1 Container=mycontainer Blob=
2022-03-10T21:38:40.974Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 verbose: DispatchMiddleware: Dispatching request...
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: DispatchMiddleware: Operation=Container_GetPropertiesWithHead
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 verbose: AuthenticationMiddlewareFactory:createAuthenticationMiddleware() Validating authentications.
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: PublicAccessAuthenticator:validate() Start validation against public access.
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 debug: PublicAccessAuthenticator:validate() Getting account properties...
2022-03-10T21:38:40.975Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 debug: PublicAccessAuthenticator:validate() Retrieved account name from context: devstoreaccount1, container: mycontainer, blob:
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 debug: PublicAccessAuthenticator:validate() Skip public access authentication. Cannot get public access type for container mycontainer
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() Start validation against account shared key authentication.
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() [STRING TO SIGN]:"HEAD\n\n\n\n\n\nThu, 10 Mar 2022 21:38:40 GMT\n\n\n\n\n\nx-ms-date:Thu, 10 Mar 2022 21:38:40 GMT\nx-ms-version:2018-11-09\n/devstoreaccount1/devstoreaccount1/mycontainer\nrestype:container"
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() Calculated authentication header based on key1: SharedKey devstoreaccount1:ZcI+nKZCm+260jInOhN6pldx2egt9NGnNfHpu3lUk5g=
2022-03-10T21:38:40.976Z 050dde15-bc8e-493c-89cf-7cdfd53213f9 info: BlobSharedKeyAuthenticator:validate() Validation failed.
----------------------------------------
Please be sure to remove any PII or sensitive information before sharing!
The debug log will log raw request headers and bodies, so that we can replay these against Azurite using REST and create tests to validate resolution.
### Have you found a mitigation/solution?
Modified the application to send only x-ms-date header and use it for authentication string.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.