Querystring handling incorrect for signature generation

Open
#26 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
52/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
aws, javascript
Domain
authentication, cloud, security

Research direction

Start in src/functions/auth/auth.mjs around lines 40-48 and compare the current HttpRequest construction with the AWS Signature Version 4 canonicalization documentation. Exercise the auth function with a Lambda function URL containing query parameters, ensuring URI and query values are passed separately. Done means requests with query strings produce valid signatures.

Written by the indexing model from the issue text.

Description

Came across the Protecting an AWS Lambda function URL with Amazon CloudFront and Lambda@Edge blog post. As I attempted to leverage the auth function in a more generalized solution, I encountered issues where the signature was invalid (example: The request signature we calculated does not match the signature you provided). After debugging and reviewing signature generation documentation, my issues were related to function url calls with querystring values. Specifically here:

https://github.com/aws-samples/aws-lambda-function-url-secured/blob/40eb7fed7d02edbb3f3f0ff2d969ed2ff73f8d6c/src/functions/auth/auth.mjs#L40-L48

Based on the signature generation documentation, it's important for the uri and querystrings to be handled separately for canonicalization. In order for valid signatures to be generated, I needed to change the above to something along the lines of the following where querystrings are provided to the request as a QueryParameterBag:

  const query = {};
  for (const qs of request.querystring.split('&')) {
    const pieces = qs.split('=');
    query[pieces[0]] = pieces[1];
  }

  // build the request to sign
  const req = new HttpRequest({
    hostname,
    path: request.uri,
    query: query,
    body: (request.body && request.body.data) ? Buffer.from(request.body.data, request.body.encoding) : undefined,
    method: request.method,
  });
Dominant language
TypeScript
Stars
27
Forks
7
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from aws-samples/aws-lambda-function-url-secured

All issues in aws-samples/aws-lambda-function-url-secured

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.