Skip to content

Handle Amazon header formatting so pre-signed S3 PUT URLs with metadata result in valid signatures#2044

Open
ryanmab wants to merge 2 commits intoasync-aws:masterfrom
ryanmab:bug/format-amazon-headers-for-pre-signing
Open

Handle Amazon header formatting so pre-signed S3 PUT URLs with metadata result in valid signatures#2044
ryanmab wants to merge 2 commits intoasync-aws:masterfrom
ryanmab:bug/format-amazon-headers-for-pre-signing

Conversation

@ryanmab
Copy link

@ryanmab ryanmab commented Feb 27, 2026

Description

Closes #2043.

Pre-signed S3 PUT requests (with user-defined metadata) are rejected by S3 because the signature is not valid.

This was caused by a change in the formatting of the user-defined metadata keys.

This fixes the issue by preserving the casing of S3 user-defined metadata - I've validated on my side that S3 PUT requests are now accepted.

Can we apply the case change to X-Amz-Meta- still, if the signature also includes the case change?

I tried uniformly applying formatAmazonHeader to all x-amz values in the buildCanonicalRequest too (so everything formatted as X-Amz-<something> and X-Amz-Meta-<something>), thinking it was just because the canonical request was still in lowercase and that effected the signature. However that didn't appear to make a difference - the signatures were still rejected by S3.

I haven't looked into the official AWS SDK, but my assumption from the docs is its an expectation that the user-defined metadata is all lowercase.

@ryanmab ryanmab force-pushed the bug/format-amazon-headers-for-pre-signing branch 4 times, most recently from 3bd5c8c to cf5966d Compare February 27, 2026 20:03
@ryanmab ryanmab marked this pull request as ready for review February 27, 2026 20:12
{
if (
'x-amz' === substr($key, 0, 5)
&& 'x-amz-meta' !== substr($key, 0, 10)
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the change.

@jderusse
Copy link
Member

thank you for this PR, I'm currently AFK, I'll have a deeper look latter.

I believe all of these issues have the same origin: We convert header's key to lowercase.. then we tried to revert the process to convert to camel case.
IMHO this is wrong. If we keep the original case all of these issues will disappear.

@ryanmab ryanmab force-pushed the bug/format-amazon-headers-for-pre-signing branch from ece62a6 to 17df2fc Compare February 28, 2026 12:28
@ryanmab
Copy link
Author

ryanmab commented Feb 28, 2026

thank you for this PR, I'm currently AFK, I'll have a deeper look latter.

I believe all of these issues have the same origin: We convert header's key to lowercase.. then we tried to revert the process to convert to camel case. IMHO this is wrong. If we keep the original case all of these issues will disappear.

@jderusse No worries at all, just whenever you have a free moment.

Agree on the point about preserving the original case - I don't necessarily know how involved that change is at the minute, but I'd be happy to pitch in in the evenings, and help with a follow up PR to do that!

@ryanmab ryanmab changed the title Handle Amazon header formatting so pre-signed S3 PUT URLs with metadata result in a valid signatures Handle Amazon header formatting so pre-signed S3 PUT URLs with metadata result in valid signatures Feb 28, 2026
@ryanmab
Copy link
Author

ryanmab commented Mar 4, 2026

@jderusse @GrahamCampbell apologies for the chaser - I’m sure you’re super busy. I’m just keen to get this merged and pre-signing back working when we can!

Anything you need from me on this for now?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Pre-signing S3 PUT requests with object metadata causing SignatureDoesNotMatch error

3 participants