aws-samples / aws-samples/aws-lambda-function-url-secured

Querystring handling incorrect for signature generation

Ouverte
#26 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
TypeScript
Étoiles
27
Forks
7
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

Came across the [Protecting an AWS Lambda function URL with Amazon CloudFront and Lambda@Edge](https://aws.amazon.com/blogs/compute/protecting-an-aws-lambda-function-url-with-amazon-cloudfront-and-lambdaedge/) blog post. As I attempted to leverage the auth function in a more generalized solution, I encountered issues where the signature was invalid (example: `The request signature we calculated does not match the signature you provided`). After debugging and reviewing signature generation documentation, my issues were related to function url calls with querystring values. Specifically here:

https://github.com/aws-samples/aws-lambda-function-url-secured/blob/40eb7fed7d02edbb3f3f0ff2d969ed2ff73f8d6c/src/functions/auth/auth.mjs#L40-L48

Based on the signature generation [documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html), it's important for the uri and querystrings to be handled separately for canonicalization. In order for valid signatures to be generated, I needed to change the above to something along the lines of the following where querystrings are provided to the request as a `QueryParameterBag`:
```javascript
const query = {};
for (const qs of request.querystring.split('&')) {
const pieces = qs.split('=');
query[pieces[0]] = pieces[1];
}

// build the request to sign
const req = new HttpRequest({
hostname,
path: request.uri,
query: query,
body: (request.body && request.body.data) ? Buffer.from(request.body.data, request.body.encoding) : undefined,
method: request.method,
});
```

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start in src/functions/auth/auth.mjs around lines 40-48 and compare the current HttpRequest construction with the AWS Signature Version 4 canonicalization documentation. Exercise the auth function with a Lambda function URL containing query parameters, ensuring URI and query values are passed separately. Done means requests with query strings produce valid signatures.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
aws, javascript
Domaine
authentication, cloud, security
Type d'issue
Bug
Difficulté
2/5
Temps estimé
1-3 heures
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
52/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.