aws / aws/aws-sdk-java-v2

Incorrect Base64 encoded x-amz-content-sha256 value

Open
#3,807 7 comments 0 reactions 1 assignee Claimed by @debora-ito View on GitHub
bug p3
Dominant language
Java
Stars
2.6k
Forks
1k
Avg merge
2d 9h
Merged PRs (30d)
51

Description

### Describe the bug

SigV4 Signing produces incorrect value for checksum header

This [line in AbstractAws4Signer](https://github.com/aws/aws-sdk-java-v2/blob/master/core/auth/src/main/java/software/amazon/awssdk/auth/signer/internal/AbstractAws4Signer.java#L452) is producing base64 encoded values for the `x-amz-content-sha256` header instead of the required "Lowercase base 16 encoding." value.

### Expected Behavior

The `x-amz-content-sha256` header value should be `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`

### Current Behavior

The `x-amz-content-sha256` header value currently produced is `47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=` and signature verification fails

### Reproduction Steps

Construct signing params
```java
Aws4SignerParams params =
Aws4SignerParams.builder()
.signingName(signingName)
.signingRegion(signingRegion)
.awsCredentials(credentialsProvider.resolveCredentials())
.checksumParams(
SignerChecksumParams.builder()
.algorithm(Algorithm.SHA256)
.isStreamingRequest(false)
.checksumHeaderName(SignerConstant.X_AMZ_CONTENT_SHA256)
.build())
.build();
```

Create a signer
```java
Aws4Signer signer = Aws4Signer.create();
```

Sign and inspect the header value
```
SdkHttpFullRequest sdkRequest = SdkHttpFullRequest.builder()....build();
SdkHttpFullRequest signedSdkRequest = signer.sign(sdkRequest, params);

signedSdkRequest.headers().get("x-amz-content-sha256")
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS Java SDK version used

master

### JDK version used

Java 17

### Operating System and version

OSC

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.