fix(credential-provider-http): fix token and URI path priority resolution (#8159)

Author: smilkuri

packages-internal/credential-provider-http/src/fromHttp/fromHttp.integ.spec.ts

@@ -1,5 +1,8 @@
+import fs from "node:fs";
 import http from "node:http";
 import type { AddressInfo, Socket } from "node:net";
+import os from "node:os";
+import path from "node:path";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { fromHttp } from "./fromHttp";
@@ -9,6 +12,10 @@ describe("fromHttp socket cleanup", () => {
   let port: number;
   let activeConnections: Set<Socket>;
 
+  let tokenServer: http.Server;
+  let tmpDir: string;
+
+
   beforeAll(async () => {
     activeConnections = new Set();
 
@@ -38,6 +45,13 @@ describe("fromHttp socket cleanup", () => {
       socket.destroy();
     }
     await new Promise<void>((resolve) => server.close(() => resolve()));
+
+    if (tokenServer) {
+      await new Promise<void>((resolve) => tokenServer.close(() => resolve()));
+    }
+    if (tmpDir) {
+      fs.rmSync(tmpDir, { recursive: true });
+    }
   });
 
   it("destroys sockets after each credential fetch", async () => {
@@ -56,6 +70,42 @@ describe("fromHttp socket cleanup", () => {
     expect(activeConnections.size).toBe(0);
   });
 
+  it("re-reads token file on each request", async () => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "fromHttp-integ-"));
+    const tokenFile = path.join(tmpDir, "token");
+    fs.writeFileSync(tokenFile, "token-v1");
+
+    const receivedAuths: string[] = [];
+    tokenServer = http.createServer((req, res) => {
+      receivedAuths.push(req.headers.authorization ?? "");
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          AccessKeyId: "AKID",
+          SecretAccessKey: "SECRET",
+          Token: "TOKEN",
+          Expiration: new Date(Date.now() + 3600_000).toISOString(),
+        })
+      );
+    });
+
+    await new Promise<void>((resolve) => tokenServer.listen(0, "127.0.0.1", resolve));
+    const tokenPort = (tokenServer.address() as AddressInfo).port;
+
+    const provider = fromHttp({
+      awsContainerCredentialsFullUri: `http://127.0.0.1:${tokenPort}/creds`,
+      awsContainerCredentialsRelativeUri: "",
+      awsContainerAuthorizationTokenFile: tokenFile,
+    });
+
+    await provider();
+    fs.writeFileSync(tokenFile, "token-v2");
+    await provider();
+
+    expect(receivedAuths[0]).toBe("token-v1");
+    expect(receivedAuths[1]).toBe("token-v2");
+  });
+
   it("destroys sockets even when requests fail", async () => {
     // Use a server that always returns 500 to trigger retries and failure.
     const failServer = http.createServer((_, res) => {

packages-internal/credential-provider-http/src/fromHttp/fromHttp.spec.ts

@@ -1,6 +1,6 @@
 import { HttpResponse } from "@smithy/core/protocols";
 import { Readable } from "node:stream";
-import { afterAll, describe, expect, test as it, vi } from "vitest";
+import { afterAll, beforeEach, describe, expect, test as it, vi } from "vitest";
 
 import { fromHttp } from "./fromHttp";
 import * as helpers from "./requestHelpers";
@@ -51,6 +51,11 @@ vi.mock("fs/promises", () => ({
 }));
 
 describe(fromHttp.name, () => {
+  beforeEach(() => {
+    mockHandle.mockClear();
+    mockDestroy.mockClear();
+  });
+
   afterAll(() => {
     vi.resetAllMocks();
   });
@@ -81,9 +86,23 @@ describe(fromHttp.name, () => {
     });
   });
 
+  it("relative uri should take precedence over full uri", async () => {
+    const provider = fromHttp({
+      awsContainerCredentialsFullUri: "https://u1.aws",
+      awsContainerCredentialsRelativeUri: "/credential-path",
+    });
+
+    await provider();
+
+    expect(mockHandle).toHaveBeenCalledWith(helpers.createGetRequest(new URL("http://169.254.170.2/credential-path")), {
+      requestTimeout: 1000,
+    });
+  });
+
   it("can use the token", async () => {
     const provider = fromHttp({
       awsContainerCredentialsFullUri: "https://t1.aws",
+      awsContainerCredentialsRelativeUri: "",
       awsContainerAuthorizationToken: mockToken,
     });
 
@@ -98,20 +117,48 @@ describe(fromHttp.name, () => {
   it("can use the token file", async () => {
     const provider = fromHttp({
       awsContainerCredentialsFullUri: "https://t2.aws",
+      awsContainerCredentialsRelativeUri: "",
       awsContainerAuthorizationTokenFile: "some-file",
     });
 
-    const request = helpers.createGetRequest(new URL("https://t1.aws"));
+    const request = helpers.createGetRequest(new URL("https://t2.aws"));
+    request.headers.Authorization = mockToken;
+
+    await provider();
+
+    expect(mockHandle).toHaveBeenCalledWith(request, { requestTimeout: 1000 });
+  });
+
+  it("token file takes precedence over token", async () => {
+    const provider = fromHttp({
+      awsContainerCredentialsFullUri: "https://t3.aws",
+      awsContainerCredentialsRelativeUri: "",
+      awsContainerAuthorizationToken: "static-token",
+      awsContainerAuthorizationTokenFile: "some-file",
+    });
+
+    const request = helpers.createGetRequest(new URL("https://t3.aws"));
     request.headers.Authorization = mockToken;
 
     await provider();
 
     expect(mockHandle).toHaveBeenCalledWith(request, { requestTimeout: 1000 });
   });
 
+  it("rejects token containing \\r\\n", async () => {
+    const provider = fromHttp({
+      awsContainerCredentialsFullUri: "https://t4.aws",
+      awsContainerCredentialsRelativeUri: "",
+      awsContainerAuthorizationToken: "Bearer token\r\nX-Injected: header",
+    });
+
+    await expect(provider()).rejects.toThrow("Authorization token contains invalid \\r\\n sequence.");
+  });
+
   it("passes custom timeout as requestTimeout to handle()", async () => {
     const provider = fromHttp({
       awsContainerCredentialsFullUri: "https://u1.aws",
+      awsContainerCredentialsRelativeUri: "",
       timeout: 5000,
     });
 
@@ -121,10 +168,9 @@ describe(fromHttp.name, () => {
   });
 
   it("destroys the request handler after the provider resolves", async () => {
-    mockDestroy.mockClear();
-
     const provider = fromHttp({
       awsContainerCredentialsFullUri: "https://u1.aws",
+      awsContainerCredentialsRelativeUri: "",
     });
 
     await provider();
@@ -133,14 +179,14 @@ describe(fromHttp.name, () => {
   });
 
   it("destroys the request handler even when the request fails", async () => {
-    mockDestroy.mockClear();
     mockHandle.mockRejectedValueOnce(new Error("network error"));
     mockHandle.mockRejectedValueOnce(new Error("network error"));
     mockHandle.mockRejectedValueOnce(new Error("network error"));
     mockHandle.mockRejectedValueOnce(new Error("network error"));
 
     const provider = fromHttp({
       awsContainerCredentialsFullUri: "https://u1.aws",
+      awsContainerCredentialsRelativeUri: "",
     });
 
     await expect(provider()).rejects.toThrow();

packages-internal/credential-provider-http/src/fromHttp/fromHttp.ts

@@ -37,21 +37,21 @@ export const fromHttp = (options: FromHttpOptions = {}): AwsCredentialIdentityPr
       "@aws-sdk/credential-provider-http: " +
         "you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri."
     );
-    warn("awsContainerCredentialsFullUri will take precedence.");
+    warn("awsContainerCredentialsRelativeUri will take precedence.");
   }
 
   if (token && tokenFile) {
     warn(
       "@aws-sdk/credential-provider-http: " +
         "you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile."
     );
-    warn("awsContainerAuthorizationToken will take precedence.");
+    warn("awsContainerAuthorizationTokenFile will take precedence.");
   }
 
-  if (full) {
-    host = full;
-  } else if (relative) {
+  if (relative) {
     host = `${DEFAULT_LINK_LOCAL_HOST}${relative}`;
+  } else if (full) {
+    host = full;
   } else {
     throw new CredentialsProviderError(
       `No HTTP credential provider host provided.
@@ -73,12 +73,12 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
     async (): Promise<AwsCredentialIdentity> => {
       const request = createGetRequest(url);
 
-      if (token) {
-        request.headers.Authorization = token;
-      } else if (tokenFile) {
+      if (tokenFile) {
         // Note: specification requires a file read on each request
         // to allow for updates to the file contents.
-        request.headers.Authorization = (await fs.readFile(tokenFile)).toString();
+        request.headers.Authorization = validateToken((await fs.readFile(tokenFile)).toString());
+      } else if (token) {
+        request.headers.Authorization = validateToken(token);
       }
       try {
         const result = await requestHandler.handle(request, { requestTimeout });
@@ -99,3 +99,15 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
     }
   };
 };
+
+/**
+ * Validates that the token does not contain the \r\n sequence
+ * that would otherwise break the HTTP request.
+ * @internal
+ */
+const validateToken = (token: string): string => {
+  if (token.includes("\r\n")) {
+    throw new CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
+  }
+  return token;
+};