googleapis / googleapis/google-cloud-node

signBlob signatures guaranteed to be valid for only 12 hours

Open
#7,773 0 comments 0 reactions 0 assignees View on GitHub
library: google-cloud-node-core type: docs
Dominant language
TypeScript
Stars
3.2k
Forks
712
Avg merge
2d 3h
Merged PRs (30d)
99

Description

The current comments fail to say how long a signed blob will be valid.

https://github.com/googleapis/google-auth-library-nodejs/blob/883cf2596664b7de8159fb29a8f16705218a2ad4/src/auth/googleauth.ts#L880

From the iam.serviceAccounts.signBlob documentation:
```
The key used for signing will remain valid for at least 12 hours after the blob is signed.
```

This means the default behavior only generates signatures valid for up to 12 hours (may be longer, but not guaranteed to be). This turns out to be a practical problem for most users of googleapis/nodejs-storage relying on the default authClient.sign behavior for signing URLs. Even when the TTL is specified in the signature (up to 7 days for v4 signatures) the default underlying signature is only good for up to 12 hours.

This should at least be documented in both the auth library and storage library, and the storage library may consider restricting TTLs on signed URLs to 12 hours (rejecting requests for longer TTLs when used with the service-account signBlob API)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.