botocore icon indicating copy to clipboard operation
botocore copied to clipboard

Allow signing with custom timestamp

Open ThrawnCA opened this issue 5 years ago • 4 comments

Is your feature request related to a problem? Please describe.

Signed URLs to static resources like S3 objects are hard to cache, because they change every time. There is a suggested approach at https://advancedweb.hu/how-to-use-s3-signed-urls-with-cloudfront/ but it relies on monkey-patching the system time function(s), which can lead to race conditions when running multiple threads.

Describe the solution you'd like

We would like to be able to pass a custom timestamp to the functions in botocore/signers.py. This would allow us to eg round the current time down to the previous half-hour, generate an S3 pre-signed URL from that with 1-hour expiry, send it to the client, and cache the result in CloudFront. That way, for a half-hour at a time, the same pre-signed URL will be generated each time, and CloudFront can serve the object from cache.

ThrawnCA avatar Nov 23 '20 03:11 ThrawnCA

We've found an alternative solution to this, by generating a signature with the current time but then caching it for the desired length. On the other hand, that requires an external cache (we're using Redis), so there is still a use case for this feature.

ThrawnCA avatar Jan 22 '21 02:01 ThrawnCA

Greetings! It looks like this issue hasn’t been active in longer than one year. We encourage you to check if this is still an issue in the latest release. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or upvote with a reaction on the initial post to prevent automatic closure. If the issue is already closed, please feel free to open a new one.

github-actions[bot] avatar Jan 22 '22 03:01 github-actions[bot]

We've found an alternative solution for the majority of this, but it may still have a use.

ThrawnCA avatar Jan 23 '22 23:01 ThrawnCA

This should be great for another use case: easier mocking time for the testing Boto behavior. Solutions like freezegun exist, but they aren't always compatible with other python modules. Being able to inject a specific time for Boto signing would greatly improve ease of use.

robbat2 avatar Aug 01 '23 04:08 robbat2