minio-go icon indicating copy to clipboard operation
minio-go copied to clipboard

Add date if not present and there is no "X-Amz-Date"

Open zhutianhao opened this issue 2 years ago • 2 comments

Upon receiving the request, Amazon S3 re-creates the string to sign using information in the Authorization header and the date header. It then verifies with authentication service the signatures match. The request date can be specified by using either the HTTP Date or the x-amz-date header. If both headers are present, x-amz-date takes precedence.

zhutianhao avatar Aug 02 '22 07:08 zhutianhao

Although V2 has been deprecated, there are still a few cases where v2 is used. The following link explains the usage of x-amz-date.

Signing and authenticating REST requests - Amazon Simple Storage Servicehttps://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html Time stamp requirement

……

Therefore, if you include the x-amz-date header, use the empty string for the Date when constructing the StringToSign.

……

zhutianhao avatar Aug 03 '22 03:08 zhutianhao

I don't see any advantage in adding this code, most of the users of MinIO or any S3 for that matter are not going to use v2 and even if they do, they are not going to set x-amz-date header usually. They will expect the SDK to handle this. Even if they do, the SDK additionally sets Date header, and MinIO will anyway honor just x-amz-date header, even if Date header is present. So, I think existing code is fine.

kannappanr avatar Aug 04 '22 08:08 kannappanr

Do not have substantial evidence on why this is needed, closing for now.

harshavardhana avatar Sep 17 '22 08:09 harshavardhana