You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "mlibbey (via GitHub)" <gi...@apache.org> on 2025/10/24 00:56:20 UTC

[PR] Exclude hop-by-hop headers from AWS v4 signature in origin_server_auth plugin [trafficserver]

mlibbey opened a new pull request, #12608:
URL: https://github.com/apache/trafficserver/pull/12608

   The plugin was incorrectly including hop-by-hop headers like 'TE' in the AWS v4 signature calculation, causing origin servers to return 400 errors.
   
   Per AWS documentation,
   https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html hop-by-hop headers that are frequently altered during transit should not be included in signatures. This includes:
   - connection
   - x-amzn-trace-id
   - user-agent
   - keep-alive
   - transfer-encoding
   - te
   - trailer
   - upgrade
   - proxy-authorization
   - proxy-authenticate
   
   These headers are now excluded from the default exclude list to prevent signature validation failures at the origin server.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Exclude hop-by-hop headers from AWS v4 signature in origin_server_auth plugin [trafficserver]

Posted by "cmcfarlen (via GitHub)" <gi...@apache.org>.
cmcfarlen commented on PR #12608:
URL: https://github.com/apache/trafficserver/pull/12608#issuecomment-3513507694

   This was marked for 10.1.x but these files don't exist in that branch.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Exclude hop-by-hop headers from AWS v4 signature in origin_server_auth plugin [trafficserver]

Posted by "mlibbey (via GitHub)" <gi...@apache.org>.
mlibbey merged PR #12608:
URL: https://github.com/apache/trafficserver/pull/12608


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Exclude hop-by-hop headers from AWS v4 signature in origin_server_auth plugin [trafficserver]

Posted by "mlibbey (via GitHub)" <gi...@apache.org>.
mlibbey commented on PR #12608:
URL: https://github.com/apache/trafficserver/pull/12608#issuecomment-3457746024

   Thanks @jasmine-nahrain -- updated and the checks are now passing :)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Exclude hop-by-hop headers from AWS v4 signature in origin_server_auth plugin [trafficserver]

Posted by "jasmine-nahrain (via GitHub)" <gi...@apache.org>.
jasmine-nahrain commented on PR #12608:
URL: https://github.com/apache/trafficserver/pull/12608#issuecomment-3443974184

   Looks like the test failed because user-agent is no longer in the output.  You can just remove user-agent from the gold file and it should pass


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Exclude hop-by-hop headers from AWS v4 signature in origin_server_auth plugin [trafficserver]

Posted by "jasmine-nahrain (via GitHub)" <gi...@apache.org>.
jasmine-nahrain commented on PR #12608:
URL: https://github.com/apache/trafficserver/pull/12608#issuecomment-3514464513

   It must be the UDS tests that dont exist


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org