Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Verify inbound SigV4 presigned URLs (query-string auth) in resolve_identity

Abierto
  • ¿Algo no está bien?
#53 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@alukach ya está trabajando en esto.

Desde el 22/7/2026.

  • #125 de @alukach — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
55/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Tranquilo
Stack tecnológico
aws, rust
Área
api, authentication

Línea de trabajo

Empieza con crates/core/src/auth/identity.rs::resolve_identity y crates/core/src/auth/sigv4.rs::verify_sigv4_signature; después, lee los vectores existentes en crates/core/src/auth/tests.rs. Añade la verificación de consultas presigned con comprobaciones de expiración y de tokens temporales, y amplía las pruebas para incluir requests válidos, manipulados, expirados y autenticados mediante token. El trabajo se considera completo cuando también se haya publicado la minor release solicitada para los consumidores posteriores.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

Add support for verifying inbound SigV4 presigned URLs (signature carried in the query string) in the auth layer. Today resolve_identity only authenticates requests whose SigV4 material is in the Authorization header; presigned requests are treated as anonymous.

This unblocks presigned-URL support in the Source Cooperative data proxy — see downstream issue: source-cooperative/data.source.coop#136. The proxy wants to issue standard AWS SigV4 presigned GET URLs (generated with STS temp creds) that browser data-viewers can fetch directly, while the proxy still streams the bytes.

Current behavior (the gap)

crates/core/src/auth/identity.rs::resolve_identity:

  • Returns ResolvedIdentity::Anonymous whenever there is no Authorization header.
  • Reads the session token (x-amz-security-token) and payload hash (x-amz-content-sha256) from headers.

For a presigned URL, all SigV4 material is in the query string (X-Amz-Algorithm, X-Amz-Credential, X-Amz-Date, X-Amz-Expires, X-Amz-SignedHeaders, X-Amz-Security-Token, X-Amz-Signature), and the canonical request is constructed differently. So presigned requests currently fail to authenticate.

Much of the machinery already exists and is reusable: crates/core/src/auth/sigv4.rs::verify_sigv4_signature already takes a query_string and canonicalize_query_string already sorts it; the SigV4Auth struct, signing-key derivation, and constant_time_eq can all be shared.

Proposed change

In crates/core/src/auth/sigv4.rs + crates/core/src/auth/identity.rs:

  1. Detect presigned requests in resolve_identity — if the query contains X-Amz-Algorithm=AWS4-HMAC-SHA256 (or X-Amz-Signature), take a presigned branch before the Anonymous early-return.
  2. Parse SigV4 from the query — new parse_sigv4_presigned(query) producing a SigV4Auth (reuse the existing credential-scope split) plus expires and the security token. Pull X-Amz-Credential, X-Amz-SignedHeaders, X-Amz-Signature, X-Amz-Date, X-Amz-Expires, X-Amz-Security-Token.
  3. Presigned canonical-request variant — either parameterize verify_sigv4_signature or add a sibling:
    • Canonical query = all query params except X-Amz-Signature, sorted/encoded (strip it, then canonicalize_query_string).
    • Payload hash = the literal string UNSIGNED-PAYLOAD.
    • string_to_sign date comes from the X-Amz-Date query param (not the x-amz-date header).
    • Reuse the existing signing-key derivation and constant_time_eq.
  4. Enforce expiry — reject when X-Amz-Date + X-Amz-Expires < now (small clock-skew allowance).
  5. Session token — resolve X-Amz-Security-Token through the existing credential_resolver (TemporaryCredentialResolver), keep the access-key↔token match check, and return the same ResolvedIdentity::Authenticated. Everything downstream (authorize → presign-backend → stream) is unchanged.

Tests

Add AWS SigV4 presigned test vectors alongside the existing header-auth vectors in crates/core/src/auth/tests.rs:

  • A known presigned canonical request → expected signature (positive).
  • Tampered query param → signature mismatch.
  • X-Amz-Date + X-Amz-Expires in the past → expired/denied.
  • With X-Amz-Security-Token resolved via a stub TemporaryCredentialResolver → Authenticated.

Release

Cut a minor release so downstream consumers (the data proxy, currently on 0.4.0) can bump.

Filed alongside source-cooperative/data.source.coop#136.

Lenguaje dominante
Rust
Estrellas
20
Forks
1
Merge medio
1 d 8 h
PR fusionados (30 d)
10

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de developmentseed/multistore

Todos los issues de developmentseed/multistore

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.