Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

RDS auth tokens and presigned URLs get an expiry one hour too long during the autumn DST change

Aperta
  • Qualcosa non va?
#3,392 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
php
Ambito
api, backend

Direzione di ricerca

Start by reading SignatureV4::convertToTimestamp() and its timestamp parsing tests; the issue identifies this method and provides a reproducible case in Europe/Berlin. Check how relative expiries are converted around the autumn DST transition, then verify that '+15 minutes' produces X-Amz-Expires=900 while other expiry forms retain their behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug investigating p2
Describe the bug

A relative expiry like '+15 minutes' gives a presigned URL that is valid one hour too long when the default timezone has a daylight saving time (DST) change and the expiry falls into the repeated hour.

SignatureV4::convertToTimestamp() resolves the string with strtotime($value, $start) in the default timezone. strtotime() adds hours, minutes and seconds as wall-clock time. On the autumn change the wall-clock result exists twice, and PHP picks the later one (standard time). The SDK uses relative expiries itself, so this affects:

  • Aws\Rds\AuthTokenGenerator::createToken() ('+15 minutes'): the token gets X-Amz-Expires=4500. RDS and RDS Proxy refuse it, and every IAM database login fails for 75 minutes (1045 Access denied … (using password: NO)).
  • Aws\DSQL\AuthTokenGenerator, PollyClient::createSynthesizeSpeechPreSignedUrl() ('+15 minutes'), PresignUrlMiddleware ('+1 hour'), and every user call such as S3Client::createPresignedRequest($cmd, '+20 minutes').
Regression Issue
  • Select this option if this issue appears to be a regression.
Expected Behavior

'+15 minutes' gives X-Amz-Expires=900 at any time of the year.

Current Behavior

From 01:45 to 02:59:59 local summer time on the night of the autumn change (Europe/Berlin: 2026-10-24T23:45Z to 2026-10-25T00:59:59Z), X-Amz-Expires=4500. America/New_York has the same problem on 2026-11-01 ('+20 minutes' at 01:50 EDT gives 4800).

Reproduction Steps
date_default_timezone_set('Europe/Berlin');
$now = strtotime('2026-10-24T23:45:00Z');          // 01:45 CEST
var_dump(strtotime('+15 minutes', $now) - $now);   // int(4500), expected 900

$signer = new Aws\Signature\SignatureV4('rds-db', 'eu-central-1');
$request = new GuzzleHttp\Psr7\Request('GET', 'https://db.example:3306/?Action=connect&DBUser=app');
$url = (string) $signer->presign(
    $request,
    new Aws\Credentials\Credentials('AKID', 'SECRET'),
    '+15 minutes',
    ['start_time' => $now]
)->getUri();
// $url contains X-Amz-Expires=4500
Possible Solution

In convertToTimestamp(), detect with date_parse() a value that is only a relative time of hours, minutes, seconds or smaller units, and add it in UTC ((new DateTimeImmutable('@' . $base))->modify($value)), where there is no DST. Keep strtotime() for all other values, so absolute dates and day-based offsets do not change. PR: (link follows)

Additional Information/Context

The spring change is not affected. Related: #1660 (one-week expiry in America/New_York).

SDK version used

3.402.0, and current master

Environment details (Version of PHP (php -v)? OS name and version, etc.)

PHP 8.5.12, date.timezone = Europe/Berlin, Linux container on AWS ECS. Reproduced on PHP 8.2, 8.3, 8.4 and 8.5.

This issue was generated by AI tools (Claude Code) and reviewed by Sebastian Detert.

Lingua principale
PHP
Stelle
6.2k
Fork
1.3k
Merge medio
2g 15h
PR unite (30g)
15

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aws/aws-sdk-php

Tutte le issue di aws/aws-sdk-php

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.