You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "fmorg-git (via GitHub)" <gi...@apache.org> on 2026/09/02 00:21:23 UTC
[PR] HDDS-16371. [STS] Better messaging for invalid endpoint path and prevent non-canonical token use [ozone]
fmorg-git opened a new pull request, #11186:
URL: https://github.com/apache/ozone/pull/11186
Please describe your PR in detail:
* This ticket addresses two issues:
1) If the wrong endpoint path is used (for example having `/invalidPath` at the end instead of the root path), then the aws client returns an opaque "Unknown" error. This ticket updates to give a more user-friendly message.
2) If a valid session token is created, and a user uses a session token that is the concatenation of the session token with itself, it is considered valid and should not be. This ticket fixes this issue as well.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-16371
## How was this patch tested?
unit and smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16371. [STS] Better messaging for invalid endpoint path and prevent non-canonical token use [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on PR #11186:
URL: https://github.com/apache/ozone/pull/11186#issuecomment-5520149674
Thanks for the review and merge.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16371. [STS] Better messaging for invalid endpoint path and prevent non-canonical token use [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on code in PR #11186:
URL: https://github.com/apache/ozone/pull/11186#discussion_r3919426706
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/STSSecurityUtil.java:
##########
@@ -160,6 +160,10 @@ private static Token<STSTokenIdentifier> decodeTokenFromString(String encodedTok
// instead of failing the OM request.
try {
token.decodeFromUrlString(encodedToken);
+ final String canonical = token.encodeToUrlString();
+ if (!canonical.equals(encodedToken)) {
Review Comment:
I don't believe it is allowed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16371. [STS] Better messaging for invalid endpoint path and prevent non-canonical token use [ozone]
Posted by "ChenSammi (via GitHub)" <gi...@apache.org>.
ChenSammi merged PR #11186:
URL: https://github.com/apache/ozone/pull/11186
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16371. [STS] Better messaging for invalid endpoint path and prevent non-canonical token use [ozone]
Posted by "ChenSammi (via GitHub)" <gi...@apache.org>.
ChenSammi commented on code in PR #11186:
URL: https://github.com/apache/ozone/pull/11186#discussion_r3910562566
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/STSSecurityUtil.java:
##########
@@ -160,6 +160,10 @@ private static Token<STSTokenIdentifier> decodeTokenFromString(String encodedTok
// instead of failing the OM request.
try {
token.decodeFromUrlString(encodedToken);
+ final String canonical = token.encodeToUrlString();
+ if (!canonical.equals(encodedToken)) {
Review Comment:
Is heading and trailing blank space allowed?
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/STSSecurityUtil.java:
##########
@@ -160,6 +160,10 @@ private static Token<STSTokenIdentifier> decodeTokenFromString(String encodedTok
// instead of failing the OM request.
try {
token.decodeFromUrlString(encodedToken);
+ final String canonical = token.encodeToUrlString();
+ if (!canonical.equals(encodedToken)) {
Review Comment:
Overall looks good. Is heading and trailing blank space allowed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org