developmentseed / developmentseed/multistore
Support SigV4 presigned URL verification
- Dominant language
- Rust
- Stars
- 19
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
## Problem
The auth module only supports **header-based** SigV4 authentication (the `Authorization` header). When no `Authorization` header is present, the request is treated as anonymous.
AWS S3 presigned URLs encode the signature in **query parameters** instead:
- `X-Amz-Algorithm`
- `X-Amz-Credential`
- `X-Amz-Date`
- `X-Amz-Expires`
- `X-Amz-SignedHeaders`
- `X-Amz-Signature`
- `X-Amz-Security-Token` (for temporary credentials)
Currently these are ignored, so presigned URLs generated with STS credentials are treated as anonymous requests.
## Why it matters
Presigned URLs are commonly used for:
- Direct ``/`` tags in browsers (can't set `Authorization` header)
- Sharing time-limited download links for restricted data
- Any context where the HTTP client can't set custom headers
Without this, the STS credential flow only works for SDK-based requests that set the `Authorization` header.
## What needs to change
1. **`resolve_identity()` in `auth/identity.rs`** — when the `Authorization` header is absent, check query parameters for `X-Amz-Algorithm=AWS4-HMAC-SHA256` before falling back to anonymous.
2. **`parse_sigv4_auth()` in `auth/sigv4.rs`** — add a parallel code path (or new function) to extract credential, signed headers, and signature from query parameters instead of the header.
3. **Signature verification** — presigned URL canonical requests differ from header-based ones:
- The `X-Amz-Signature` parameter is excluded from the canonical query string
- The payload hash is always `UNSIGNED-PAYLOAD`
- Expiration (`X-Amz-Expires`) must be validated
4. **Credential resolution** — the existing `CredentialRegistry` + `TokenKey` resolver should work as-is once the access key is extracted from the query string.
## References
- [AWS SigV4 Query String Auth](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html)
Contributor guide
Assessment
This issue has not been assessed yet.