[Bug]: aws-sdk-php v3.376.2 does not sign the `content-type` header, leading to S3 signature validation failures

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

This is more informational then anything else, as the PHP sdk already fixed this issue in https://github.com/aws/aws-sdk-php/pull/3310 (v3.385.3).

My only recommendation would be to update the nextcloud/3rdparty deps to use an SDK version >=3.385.3, which I believe is already a valid version for the current version constraint (at least for Nextcloud 34)

At present using Ceph RGW v20.2.4 with rgw_sigv4_insecure = false (see: https://ceph.io/en/news/blog/2026/v20-2-4-v19-2-6-combo-released/) leads to all Nextcloud object PUT requests erroring out with a 403.

This is due to a more strict implementation of spec defined in https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html specifically around content-type:

CanonicalHeaders list must include the following:

• If the Content-Type header is present in the request, you must add it to the CanonicalHeaders list.
  [...]

which the current version of the SDK does not do.

---

This manifests as a lot of different errors in the Nextcloud logs, but they all trace back to S3 PUT requests receiving a mysterious 403.

Steps to reproduce

1. Attempt to use a recent Ceph RGW version for main storage (v20.2.4 or v19.2.6)
2. Ensure that rgw_sigv4_insecure is unset or set to false
3. Create a file with some content in any Nextcloud client
4. Observe that it is unable to sync the file

Expected behavior

The content-type header should be included in the signed headers list (and signed)

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

None

Web server

Apache (supported)

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

N/A

List of activated Apps

N/A

Nextcloud Signing status

N/A

Nextcloud Logs

{
  "reqId": "xoEYy7Hb3hstyggdQolj",
  "level": 3,
  "time": "2026-08-22T18:28:39+00:00",
  "remoteAddr": "REDACTED",
  "user": "REDACTED",
  "app": "no app in context",
  "method": "PUT",
  "url": "/remote.php/dav/files/REDACTED/...",
  "scriptName": "/remote.php",
  "message": "Expected filesize of 24 bytes but read (from Nextcloud client) and wrote (to Nextcloud storage) -1 bytes. Could either be a network problem on the sending side or a problem writing to the storage on the server side.",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0",
  "version": "34.0.2.1",
  "exception": {
    "Exception": "Sabre\\DAV\\Exception\\BadRequest",
    "Message": "Expected filesize of 24 bytes but read (from Nextcloud client) and wrote (to Nextcloud storage) -1 bytes. Could either be a network problem on the sending side or a problem writing to the storage on the server side.",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/Directory.php",
        "line": 128,
        "function": "put",
        "class": "OCA\\DAV\\Connector\\Sabre\\File",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 1098,
        "function": "createFile",
        "class": "OCA\\DAV\\Connector\\Sabre\\Directory",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",
        "line": 504,
        "function": "createFile",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
        "line": 89,
        "function": "httpPut",
        "class": "Sabre\\DAV\\CorePlugin",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 472,
        "function": "emit",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "method:PUT",
          [
            {
              "__class__": "Sabre\\HTTP\\Request"
            },
            {
              "__class__": "Sabre\\HTTP\\Response"
            }
          ]
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Connector/Sabre/Server.php",
        "line": 215,
        "function": "invokeMethod",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/apps/dav/lib/Server.php",
        "line": 432,
        "function": "start",
        "class": "OCA\\DAV\\Connector\\Sabre\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/apps/dav/appinfo/v2/remote.php",
        "line": 25,
        "function": "exec",
        "class": "OCA\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/remote.php",
        "line": 152,
        "args": [
          "/var/www/html/apps/dav/appinfo/v2/remote.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/var/www/html/apps/dav/lib/Connector/Sabre/File.php",
    "Line": 269,
    "message": "Expected filesize of 24 bytes but read (from Nextcloud client) and wrote (to Nextcloud storage) -1 bytes. Could either be a network problem on the sending side or a problem writing to the storage on the server side.",
    "exception": "{\"class\":\"Sabre\\DAV\\Exception\\BadRequest\",\"message\":\"Expected filesize of 24 bytes but read (from Nextcloud client) and wrote (to Nextcloud storage) -1 bytes. Could either be a network problem on the sending side or a problem writing to the storage on the server side.\",\"code\":0,\"file\":\"/var/www/html/apps/dav/lib/Connector/Sabre/File.php:269\",\"trace\":\"#0 /var/www/html/apps/dav/lib/Connector/Sabre/Directory.php(128): OCA\\DAV\\Connector\\Sabre\\File->put(Resource id #10)\\n#1 /var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php(1098): OCA\\DAV\\Connector\\Sabre\\Directory->createFile('lock.json', Resource id #10)\\n#2 /var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(504): Sabre\\DAV\\Server->createFile('files/REDACTED/...', Resource id #10, NULL)\\n#3 /var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpPut(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#4 /var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit('method:PUT', Array)\\n#5 /var/www/html/apps/dav/lib/Connector/Sabre/Server.php(215): Sabre\\DAV\\Server->invokeMethod(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#6 /var/www/html/apps/dav/lib/Server.php(432): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#7 /var/www/html/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#8 /var/www/html/remote.php(152): require_once('/var/www/html/a...')\\n#9 {main}\"}",
    "CustomMessage": "Expected filesize of 24 bytes but read (from Nextcloud client) and wrote (to Nextcloud storage) -1 bytes. Could either be a network problem on the sending side or a problem writing to the storage on the server side."
  }
}

Additional info

No response

Start with the nextcloud/3rdparty composer.json dependency constraint linked in the issue and compare it with the AWS SDK release that fixes content-type signing. Update the dependency to a compatible version, then verify that S3 PUT requests against Ceph RGW with rgw_sigv4_insecure=false no longer fail with 403 errors.