adam-fowler / aws-signer-v4 Goto Github PK

Hi,

It's not an issue just maybe something to note in the README in the signHeaders example. If you don't include the trailing slash in the URL, you will get an InvalidSignatureException from AWS. Adding the trailing slash fixes the issue. This was with using POST for DynamoDB.

For anyone curious:

Here is my URL without the trailing slashes

po signingData.unsignedURL
https://dynamodb.us-west-1.amazonaws.com

po signingData.unsignedURL.path
""

As per step 2 in Task 1 of Signing AWS Requests

Add the canonical URI parameter ...

Example Canonical URI with encoding
/documents%2520and%2520settings/

Example Canonical URI
/

So, no trailing slash == 400

Great library, definitely gets the job done for us! We've vendored it and noticed an issue with how this code interacts with URLSession.

When signing a url (e.g., for S3) with a port in it, such as https://s3.amazonaws.com:443/bucket... the signature will be computed with the port. However, when requesting the content of that URL with URLSession (or Data(contentsOf:)), the port is stripped out, and the signature is no longer correct, and AWS returns a 403.

We're currently playing with a few solutions, including stripping the port before signing.