Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Not accurate error message for invalid authenticated requests #882

Merged
merged 3 commits into from
Oct 27, 2023
Merged

Not accurate error message for invalid authenticated requests #882

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bb28063
api: Use correct error check
smallhive Oct 27, 2023
e4475f5
auth: Use constant instead of string
smallhive Oct 27, 2023
d703219
auth: Return the correct error
smallhive Oct 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions api/auth/center.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@
if queryValues.Get(AmzAlgorithm) == "AWS4-HMAC-SHA256" {
creds := strings.Split(queryValues.Get(AmzCredential), "/")
if len(creds) != 5 || creds[4] != "aws4_request" {
return nil, fmt.Errorf("bad X-Amz-Credential")
return nil, s3errors.GetAPIError(s3errors.ErrCredMalformed)

Check warning on line 147 in api/auth/center.go

View check run for this annotation

Codecov / codecov/patch

api/auth/center.go#L147 

Added line #L147 was not covered by tests
}
authHdr = &authHeader{
AccessKeyID: creds[0],
Expand Down Expand Up @@ -236,9 +236,9 @@
return nil, ErrNoAuthorizationHeader
}

submatches := c.postReg.GetSubmatches(MultipartFormValue(r, "x-amz-credential"))
submatches := c.postReg.GetSubmatches(MultipartFormValue(r, strings.ToLower(AmzCredential)))

Check warning on line 239 in api/auth/center.go

View check run for this annotation

Codecov / codecov/patch

api/auth/center.go#L239 

Added line #L239 was not covered by tests
roman-khimov marked this conversation as resolved.
Show resolved Hide resolved
if len(submatches) != 4 {
return nil, s3errors.GetAPIError(s3errors.ErrAuthorizationHeaderMalformed)
return nil, s3errors.GetAPIError(s3errors.ErrCredMalformed)

Check warning on line 241 in api/auth/center.go

View check run for this annotation

Codecov / codecov/patch

api/auth/center.go#L241 

Added line #L241 was not covered by tests
}

signatureDateTime, err := time.Parse("20060102T150405Z", MultipartFormValue(r, "x-amz-date"))
Expand Down
6 changes: 4 additions & 2 deletions api/auth/signer/v4/v4.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@
authHeaderSignatureElem = "Signature="
signatureQueryKey = "X-Amz-Signature"

amzCredential = "X-Amz-Credential"

authHeaderPrefix = "AWS4-HMAC-SHA256"
timeFormat = "20060102T150405Z"
shortTimeFormat = "20060102"
Expand Down Expand Up @@ -597,7 +599,7 @@
ctx.credentialString = buildSigningScope(ctx.Region, ctx.ServiceName, ctx.Time)

if ctx.isPresign {
ctx.Query.Set("X-Amz-Credential", ctx.credValues.AccessKeyID+"/"+ctx.credentialString)
ctx.Query.Set(amzCredential, ctx.credValues.AccessKeyID+"/"+ctx.credentialString)

Check warning on line 602 in api/auth/signer/v4/v4.go

View check run for this annotation

Codecov / codecov/patch

api/auth/signer/v4/v4.go#L602 

Added line #L602 was not covered by tests
}
}

Expand Down Expand Up @@ -747,7 +749,7 @@
ctx.Query.Del("X-Amz-Security-Token")
ctx.Query.Del("X-Amz-Date")
ctx.Query.Del("X-Amz-Expires")
ctx.Query.Del("X-Amz-Credential")
ctx.Query.Del(amzCredential)

Check warning on line 752 in api/auth/signer/v4/v4.go

View check run for this annotation

Codecov / codecov/patch

api/auth/signer/v4/v4.go#L752 

Added line #L752 was not covered by tests
ctx.Query.Del("X-Amz-SignedHeaders")
}

Expand Down
3 changes: 2 additions & 1 deletion api/user_auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,8 @@ func AttachUserAuth(router *mux.Router, center auth.Center, log *zap.Logger) {
ctx = context.WithValue(r.Context(), AnonymousRequest, true)
} else {
log.Error("failed to pass authentication", zap.Error(err))
if _, ok := err.(s3errors.Error); !ok {
var s3err s3errors.Error
if !errors.As(err, &s3err) {
err = s3errors.GetAPIError(s3errors.ErrAccessDenied)
}
WriteErrorResponse(w, GetReqInfo(r.Context()), err)
Expand Down
Loading