From 582ad4a83295513d9f98a48b823c2f8170f3291e Mon Sep 17 00:00:00 2001
From: Repinoid <tazet@narod.ru>
Date: Sun, 11 Oct 2026 08:35:57 +0300
Subject: [PATCH] =?UTF-8?q?auth:=20=D1=81=D0=B2=D0=B5=D1=80=D1=8F=D1=82?=
 =?UTF-8?q?=D1=8C=20X-Amz-Content-Sha256=20=D1=81=20=D1=84=D0=B0=D0=BA?=
 =?UTF-8?q?=D1=82=D0=B8=D1=87=D0=B5=D1=81=D0=BA=D0=B8=D0=BC=20=D1=85=D1=8D?=
 =?UTF-8?q?=D1=88=D0=B5=D0=BC=20=D1=82=D0=B5=D0=BB=D0=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/auth/auth_middleware.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/app/auth/auth_middleware.go b/app/auth/auth_middleware.go
index e2c6a53..4af8bfe 100644
--- a/app/auth/auth_middleware.go
+++ b/app/auth/auth_middleware.go
@@ -163,9 +163,14 @@ func verifyHeaderSigV4(r *http.Request, t *tenant.Tenant, authHeader string) err
 	if err != nil {
 		return err
 	}
+	actualHash := sha256Hex(body)
 	payloadHash := r.Header.Get("X-Amz-Content-Sha256")
 	if payloadHash == "" {
-		payloadHash = sha256Hex(body)
+		payloadHash = actualHash
+	} else if !strings.EqualFold(payloadHash, actualHash) && !strings.EqualFold(payloadHash, "UNSIGNED-PAYLOAD") {
+		// Заголовок заявлен, но не совпадает с фактическим хэшем тела: клиент
+		// не должен иметь возможность подменить тело под подписанным заголовком.
+		return errors.New("X-Amz-Content-Sha256 does not match body hash")
 	}
 
 	canonicalRequest, err := buildCanonicalRequest(r, signedHeaders, payloadHash, true)