eclipse-paho / eclipse-paho/paho.mqtt.java

Remove Port number from Host header for standard HTTPS: Connection to presigned AWS IoT websocket URIs fails with "connection not upgraded"

Open
#830 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2.3k
Forks
919
PR merge metrics
No merged PRs in 30d

Description

- [x] Bug exists Release Version 1.2.5 ( Master Branch)
- [x] Bug exists in MQTTv3 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)
- [x] Bug exists in MQTTv5 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)

When connecting to a presigned AWS IoT URI in the form of `wss://xxxxxxx.iot..amazonaws.com/mqtt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA32D2HMOBBU5IAHIO%2F20200910%2Feu-central-1%2Fiotdevicegateway%2Faws4_request&X-Amz-Date=20200910T155612Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=7ec319b14d8905a5b170bdd2b03e258a68dca22052bfdf0f307dade2b2c7f95e&X-Amz-Security-Token=FwoGZXIvY%3D` the connection fails and AWS returns a 401 Forbidden error.

This is because the host header value is part of the signed information in the token. The header is not supposed to have the port number in it, but for some reason this exact behavior has been intentionally introduced in https://github.com/eclipse/paho.mqtt.java/commit/accb989d5f76dc669c28f5ac5ee20dd7abd159f4.

When reverting back to 1.2.1, I am able to complete the connection.

Additionally, should the HTTP return code be checked to produce more specific exceptions insted of "connection not upgraded" in this case?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.