aws-samples / aws-samples/aws-lambda-function-url-secured
Querystring handling incorrect for signature generation
- Langage dominant
- TypeScript
- Étoiles
- 27
- Forks
- 7
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
Came across the [Protecting an AWS Lambda function URL with Amazon CloudFront and Lambda@Edge](https://aws.amazon.com/blogs/compute/protecting-an-aws-lambda-function-url-with-amazon-cloudfront-and-lambdaedge/) blog post. As I attempted to leverage the auth function in a more generalized solution, I encountered issues where the signature was invalid (example: `The request signature we calculated does not match the signature you provided`). After debugging and reviewing signature generation documentation, my issues were related to function url calls with querystring values. Specifically here:
https://github.com/aws-samples/aws-lambda-function-url-secured/blob/40eb7fed7d02edbb3f3f0ff2d969ed2ff73f8d6c/src/functions/auth/auth.mjs#L40-L48
Based on the signature generation [documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html), it's important for the uri and querystrings to be handled separately for canonicalization. In order for valid signatures to be generated, I needed to change the above to something along the lines of the following where querystrings are provided to the request as a `QueryParameterBag`:
```javascript
const query = {};
for (const qs of request.querystring.split('&')) {
const pieces = qs.split('=');
query[pieces[0]] = pieces[1];
}
// build the request to sign
const req = new HttpRequest({
hostname,
path: request.uri,
query: query,
body: (request.body && request.body.data) ? Buffer.from(request.body.data, request.body.encoding) : undefined,
method: request.method,
});
```
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start in src/functions/auth/auth.mjs around lines 40-48 and compare the current HttpRequest construction with the AWS Signature Version 4 canonicalization documentation. Exercise the auth function with a Lambda function URL containing query parameters, ensuring URI and query values are passed separately. Done means requests with query strings produce valid signatures.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- aws, javascript
- Domaine
- authentication, cloud, security
- Type d'issue
- Bug
- Difficulté
- 2/5
- Temps estimé
- 1-3 heures
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 52/100