don't sign transfer-encoding header (#2991)

aws · Jan 30, 2025 · 0b4f636 · 0b4f636
1 parent b820c57
commit 0b4f636
Show file tree

Hide file tree

Showing 5 changed files with 28 additions and 7 deletions.
diff --git a/.changelog/39bec3d624bb499baf58012de54829f1.json b/.changelog/39bec3d624bb499baf58012de54829f1.json
@@ -0,0 +1,9 @@
+{
+    "id": "39bec3d6-24bb-499b-af58-012de54829f1",
+    "type": "bugfix",
+    "description": "Do not sign Transfer-Encoding header in Sigv4[a]. Fixes a signer mismatch issue with S3 Accelerate.",
+    "modules": [
+        ".",
+        "internal/v4a"
+    ]
+}
diff --git a/aws/signer/internal/v4/headers.go b/aws/signer/internal/v4/headers.go
@@ -4,10 +4,11 @@ package v4
 var IgnoredHeaders = Rules{
 	ExcludeList{
 		MapRule{
-			"Authorization":   struct{}{},
-			"User-Agent":      struct{}{},
-			"X-Amzn-Trace-Id": struct{}{},
-			"Expect":          struct{}{},
+			"Authorization":     struct{}{},
+			"User-Agent":        struct{}{},
+			"X-Amzn-Trace-Id":   struct{}{},
+			"Expect":            struct{}{},
+			"Transfer-Encoding": struct{}{},
 		},
 	},
 }

diff --git a/aws/signer/v4/v4_test.go b/aws/signer/v4/v4_test.go
@@ -162,6 +162,11 @@ func TestPresignBodyWithArrayRequest(t *testing.T) {
 
 func TestSignRequest(t *testing.T) {
 	req, body := buildRequest("dynamodb", "us-east-1", "{}")
+	// test ignored headers
+	req.Header.Set("User-Agent", "foo")
+	req.Header.Set("X-Amzn-Trace-Id", "bar")
+	req.Header.Set("Expect", "baz")
+	req.Header.Set("Transfer-Encoding", "qux")
 	signer := NewSigner()
 	err := signer.SignHTTP(context.Background(), testCredentials, req, body, "dynamodb", "us-east-1", time.Unix(0, 0))
 	if err != nil {

diff --git a/internal/v4a/internal/v4/headers.go b/internal/v4a/internal/v4/headers.go
@@ -4,9 +4,10 @@ package v4
 var IgnoredHeaders = Rules{
 	DenyList{
 		MapRule{
-			"Authorization":   struct{}{},
-			"User-Agent":      struct{}{},
-			"X-Amzn-Trace-Id": struct{}{},
+			"Authorization":     struct{}{},
+			"User-Agent":        struct{}{},
+			"X-Amzn-Trace-Id":   struct{}{},
+			"Transfer-Encoding": struct{}{},
 		},
 	},
 }

diff --git a/internal/v4a/v4a_test.go b/internal/v4a/v4a_test.go
@@ -57,6 +57,11 @@ func TestDeriveECDSAKeyPairFromSecret(t *testing.T) {
 func TestSignHTTP(t *testing.T) {
 	req := buildRequest("dynamodb", "us-east-1")
 
+	// test ignored headers
+	req.Header.Set("User-Agent", "foo")
+	req.Header.Set("X-Amzn-Trace-Id", "bar")
+	req.Header.Set("Transfer-Encoding", "qux")
+
 	signer, credProvider := buildSigner(t, true)
 
 	key, err := credProvider.RetrievePrivateKey(context.Background())