A request outside the 15 minute SigV4 window gets UnrecognizedClientException; DynamoDB answers InvalidSignatureException

未关闭 适合新手
  • 哪里不对？
#805 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 4 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
rust
领域
authentication

调研方向

该问题位于 crates/auth/src/sigv4/verify.rs 中的 validate_timestamp，它对15分钟窗口的两侧都返回同一条消息的 UnrecognizedClientException。请阅读该函数以及 outside_the_skew_window（#792）和 'Signature expired'（#512）的测试，并运行它们。完成标准是：过去和未来的时间偏差都返回 InvalidSignatureException，且消息由 X-Amz-Date 和服务器时钟按 DynamoDB 的格式构建，同时这些测试会检查错误和消息。

由索引模型根据 Issue 内容生成。

描述

Summary

When X-Amz-Date is more than 15 minutes from the clock, DynamoDB refuses the request with InvalidSignatureException, and its message names the side of the window and the times it compared. ExtendDB answers UnrecognizedClientException, with one message for both sides.

X-Amz-Date DynamoDB (us-east-1, measured 2026-11-03) ExtendDB (main 5a1d4d721, from crates/auth/src/sigv4/verify.rs)
16 minutes before the clock 400 InvalidSignatureException Signature expired: 20261103T201550Z is now earlier than 20261103T201650Z (20261103T203150Z - 15 min.) 400 UnrecognizedClientException Signature expired: the signature is too old or the request date is too far in the future.
16 minutes after the clock 400 InvalidSignatureException Signature not yet current: 20261103T204750Z is still later than 20261103T204650Z (20261103T203150Z + 15 min.) 400 UnrecognizedClientException, the same message as the row above

In both DynamoDB messages the first time is X-Amz-Date, the second is the edge of the window, and the third is the service's clock.

Each case was a ListTables request, sent twice in each of two forms:

  • signed with a clock 16 minutes off, so the signature matches its own date
  • signed at the current time, with X-Amz-Date replaced afterwards, so the signature no longer matches

Both forms got the answers above. DynamoDB checks the time before it compares the signature. So does ExtendDB: validate_timestamp runs before verify_signature.

Cause

validate_timestamp in crates/auth/src/sigv4/verify.rs returns UnrecognizedClientException with one fixed message for both sides of the window.

Fix shape

Return InvalidSignatureException with the two messages, built from X-Amz-Date and the server's clock. No test on main checks the error or the message for these requests. The outside_the_skew_window cases in #792 check only that the time check refuses these requests, with either error and any message; after this fix they can check the error and the message too. A test in #512 checks that the message for a date an hour old starts with "Signature expired". DynamoDB's message for a past date starts the same way, so that test still passes after the fix.

Raised in the review of #792.

主要语言
Rust
星标
517
派生
60
平均合并
5 天 4 小时
30 天内合并 PR
76

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ExtendDB/extenddb 的其他 Issue

查看 ExtendDB/extenddb 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。