Skip to content

Commit

Permalink
remove redirector for S3 API calls (#1601)
Browse files Browse the repository at this point in the history
S3 APIs behave in non-standard style
not following HTTP spec for redirections

Refer here

https://github.com/aws/aws-sdk-go/blob/main/service/s3/s3manager/bucket_region.go#L117

```
// Disable HTTP redirects to prevent an invalid 301 from eating the response
// because Go's HTTP client will fail, and drop the response if an 301 is
// received without a location header. S3 will return a 301 without the
// location header for HeadObject API calls.
req.DisableFollowRedirects = true
```

Fixes the issue minio/minio#13918
  • Loading branch information
harshavardhana authored Dec 20, 2021
1 parent ef709cf commit 52ffedf
Showing 1 changed file with 5 additions and 64 deletions.
69 changes: 5 additions & 64 deletions api.go
Original file line number Diff line number Diff line change
Expand Up @@ -182,67 +182,6 @@ func (r *lockedRandSource) Seed(seed int64) {
r.lk.Unlock()
}

// Redirect requests by re signing the request.
func (c *Client) redirectHeaders(req *http.Request, via []*http.Request) error {
if len(via) >= 5 {
return errors.New("stopped after 5 redirects")
}
if len(via) == 0 {
return nil
}
lastRequest := via[len(via)-1]
var reAuth bool
for attr, val := range lastRequest.Header {
// if hosts do not match do not copy Authorization header
if attr == "Authorization" && req.Host != lastRequest.Host {
reAuth = true
continue
}
if _, ok := req.Header[attr]; !ok {
req.Header[attr] = val
}
}

*c.endpointURL = *req.URL

value, err := c.credsProvider.Get()
if err != nil {
return err
}
var (
signerType = value.SignerType
accessKeyID = value.AccessKeyID
secretAccessKey = value.SecretAccessKey
sessionToken = value.SessionToken
region = c.region
)

// Custom signer set then override the behavior.
if c.overrideSignerType != credentials.SignatureDefault {
signerType = c.overrideSignerType
}

// If signerType returned by credentials helper is anonymous,
// then do not sign regardless of signerType override.
if value.SignerType == credentials.SignatureAnonymous {
signerType = credentials.SignatureAnonymous
}

if reAuth {
// Check if there is no region override, if not get it from the URL if possible.
if region == "" {
region = s3utils.GetRegionFromURL(*c.endpointURL)
}
switch {
case signerType.IsV2():
return errors.New("signature V2 cannot support redirection")
case signerType.IsV4():
signer.SignV4(*req, accessKeyID, secretAccessKey, sessionToken, getDefaultLocation(*c.endpointURL, region))
}
}
return nil
}

func privateNew(endpoint string, opts *Options) (*Client, error) {
// construct endpoint.
endpointURL, err := getEndpointURL(endpoint, opts.Secure)
Expand Down Expand Up @@ -279,9 +218,11 @@ func privateNew(endpoint string, opts *Options) (*Client, error) {

// Instantiate http client and bucket location cache.
clnt.httpClient = &http.Client{
Jar: jar,
Transport: transport,
CheckRedirect: clnt.redirectHeaders,
Jar: jar,
Transport: transport,
CheckRedirect: func(req *http.Request, via []*http.Request) error {
return http.ErrUseLastResponse
},
}

// Sets custom region, if region is empty bucket location cache is used automatically.
Expand Down

0 comments on commit 52ffedf

Please sign in to comment.