OPTIONS requests on presigned URL's wrongly check signature, causing failure for client-side requests

[mmezei]

When a browser based application uses a pre-signed URL to s3proxy (typically generated by its API), it would issue a CORS preflight OPTIONS request first. This request wrongly causes the entire operation to fail as browser does not include content-md5 and x-amz-acl headers that are required for successful signature validation. The OPTIONS request failure is a SignatureDoesNotMatch error. Amazon and Digital Ocean do not check the signature on a preflight OPTIONS request. I was able to see this by sending them a request with a bogus signature..

[rajivml]

@mmezei were you able to get pass this issue? am running into a similar issue

[mmezei]

Yes. Please see my fork... Let me know if you can't locate it.

…

On Wed, Jan 18, 2023, 3:01 PM Rajiv Chodisetti ***@***.***> wrote: @mmezei <https://github.com/mmezei> were you able to get pass this issue? am running into a similar issue — Reply to this email directly, view it on GitHub <#411 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AESJ2OXNCZFWAWMAG6RC4RLWTBD2XANCNFSM5RO7WHJQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[gaul]

Sorry I don't know much about CORS. @snoe925 is this something you could look at?

@mmezei Any reason you are maintaining a fork instead of merging fixes upstream? Switch-TV@9786ab0 seems like a plausible fix.

[mmezei]

Yes. Tried to contact upstream regarding the issues at the time and could not make contact for a pull request as author did not seem active at that time.

…

On Wed, Jan 18, 2023, 10:25 PM Andrew Gaul ***@***.***> wrote: Sorry I don't know much about CORS. @snoe925 <https://github.com/snoe925> is this something you could look at? @mmezei <https://github.com/mmezei> Any reason you are maintaining a fork instead of merging fixes upstream? ***@***.*** <Switch-TV@9786ab0> seems like a plausible fix. — Reply to this email directly, view it on GitHub <#411 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AESJ2OSG3E4U2FUAGJ4BOFTWTCX27ANCNFSM5RO7WHJQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[rajivml]

thanks @mmezei , this works

[daveanderson]

Is this Switch-TV@9786ab0 fix something that can be applied and included in a release? (I'd rather not run have to run a fork)

[Wamy-Dev]

this is still an issue for me. Any possibility of a fix @gaul ?

[gaul]

I cherry-picked this but please just submit pull requests in the future.