googleapis / googleapis/google-cloud-node

signBlob signatures guaranteed to be valid for only 12 hours

Aperta
#7,773 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
library: google-cloud-node-core type: docs
Lingua principale
TypeScript
Stelle
3.2k
Fork
713
Merge medio
2g 9h
PR unite (30g)
104

Descrizione

The current comments fail to say how long a signed blob will be valid.

https://github.com/googleapis/google-auth-library-nodejs/blob/883cf2596664b7de8159fb29a8f16705218a2ad4/src/auth/googleauth.ts#L880

From the iam.serviceAccounts.signBlob documentation:
```
The key used for signing will remain valid for at least 12 hours after the blob is signed.
```

This means the default behavior only generates signatures valid for up to 12 hours (may be longer, but not guaranteed to be). This turns out to be a practical problem for most users of googleapis/nodejs-storage relying on the default authClient.sign behavior for signing URLs. Even when the TTL is specified in the signature (up to 7 days for v4 signatures) the default underlying signature is only good for up to 12 hours.

This should at least be documented in both the auth library and storage library, and the storage library may consider restricting TTLs on signed URLs to 12 hours (rejecting requests for longer TTLs when used with the service-account signBlob API)

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start at src/auth/googleauth.ts around line 880 and compare its signBlob comments with the linked IAM signBlob validity guarantee. Then review the storage-library signed URL behavior described in the issue; done means the 12-hour limitation and any longer-TTL handling are documented or explicitly decided for both libraries.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
google-cloud, nodejs, typescript
Ambito
api, authentication, documentation
Tipo di issue
Documentazione
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.