Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Verify inbound SigV4 presigned URLs (query-string auth) in resolve_identity

Aperta
  • Qualcosa non va?
#53 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@alukach ci sta già lavorando.

Dal 22/7/2026.

  • #125 di @alukach — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
aws, rust
Ambito
api, authentication

Direzione di ricerca

Inizia da crates/core/src/auth/identity.rs::resolve_identity e crates/core/src/auth/sigv4.rs::verify_sigv4_signature, quindi leggi i vettori esistenti in crates/core/src/auth/tests.rs. Aggiungi la verifica delle query presigned con i controlli di scadenza e dei token temporanei ed estendi i test per includere richieste valide, manomesse, scadute e autenticate tramite token. Il completamento include anche la minor release richiesta per i consumer downstream.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Add support for verifying inbound SigV4 presigned URLs (signature carried in the query string) in the auth layer. Today resolve_identity only authenticates requests whose SigV4 material is in the Authorization header; presigned requests are treated as anonymous.

This unblocks presigned-URL support in the Source Cooperative data proxy — see downstream issue: source-cooperative/data.source.coop#136. The proxy wants to issue standard AWS SigV4 presigned GET URLs (generated with STS temp creds) that browser data-viewers can fetch directly, while the proxy still streams the bytes.

Current behavior (the gap)

crates/core/src/auth/identity.rs::resolve_identity:

  • Returns ResolvedIdentity::Anonymous whenever there is no Authorization header.
  • Reads the session token (x-amz-security-token) and payload hash (x-amz-content-sha256) from headers.

For a presigned URL, all SigV4 material is in the query string (X-Amz-Algorithm, X-Amz-Credential, X-Amz-Date, X-Amz-Expires, X-Amz-SignedHeaders, X-Amz-Security-Token, X-Amz-Signature), and the canonical request is constructed differently. So presigned requests currently fail to authenticate.

Much of the machinery already exists and is reusable: crates/core/src/auth/sigv4.rs::verify_sigv4_signature already takes a query_string and canonicalize_query_string already sorts it; the SigV4Auth struct, signing-key derivation, and constant_time_eq can all be shared.

Proposed change

In crates/core/src/auth/sigv4.rs + crates/core/src/auth/identity.rs:

  1. Detect presigned requests in resolve_identity — if the query contains X-Amz-Algorithm=AWS4-HMAC-SHA256 (or X-Amz-Signature), take a presigned branch before the Anonymous early-return.
  2. Parse SigV4 from the query — new parse_sigv4_presigned(query) producing a SigV4Auth (reuse the existing credential-scope split) plus expires and the security token. Pull X-Amz-Credential, X-Amz-SignedHeaders, X-Amz-Signature, X-Amz-Date, X-Amz-Expires, X-Amz-Security-Token.
  3. Presigned canonical-request variant — either parameterize verify_sigv4_signature or add a sibling:
    • Canonical query = all query params except X-Amz-Signature, sorted/encoded (strip it, then canonicalize_query_string).
    • Payload hash = the literal string UNSIGNED-PAYLOAD.
    • string_to_sign date comes from the X-Amz-Date query param (not the x-amz-date header).
    • Reuse the existing signing-key derivation and constant_time_eq.
  4. Enforce expiry — reject when X-Amz-Date + X-Amz-Expires < now (small clock-skew allowance).
  5. Session token — resolve X-Amz-Security-Token through the existing credential_resolver (TemporaryCredentialResolver), keep the access-key↔token match check, and return the same ResolvedIdentity::Authenticated. Everything downstream (authorize → presign-backend → stream) is unchanged.

Tests

Add AWS SigV4 presigned test vectors alongside the existing header-auth vectors in crates/core/src/auth/tests.rs:

  • A known presigned canonical request → expected signature (positive).
  • Tampered query param → signature mismatch.
  • X-Amz-Date + X-Amz-Expires in the past → expired/denied.
  • With X-Amz-Security-Token resolved via a stub TemporaryCredentialResolver → Authenticated.

Release

Cut a minor release so downstream consumers (the data proxy, currently on 0.4.0) can bump.

Filed alongside source-cooperative/data.source.coop#136.

Lingua principale
Rust
Stelle
20
Fork
1
Merge medio
1g 8h
PR unite (30g)
10

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di developmentseed/multistore

Tutte le issue di developmentseed/multistore

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.