Nail/SQS-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: сверять X-Amz-Content-Sha256 с фактическим хэшем тела

Browse Source
This commit is contained in:
Repinoid
2026-10-11 08:35:57 +03:00
parent 0512ea2389
commit 582ad4a832
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/auth/auth_middleware.go
+6 -1
View File
@@ -163,9 +163,14 @@ func verifyHeaderSigV4(r *http.Request, t *tenant.Tenant, authHeader string) err
if err != nil { if err != nil {
return err return err
} }
actualHash := sha256Hex(body)
payloadHash := r.Header.Get("X-Amz-Content-Sha256") payloadHash := r.Header.Get("X-Amz-Content-Sha256")
if payloadHash == "" { if payloadHash == "" {
payloadHash = sha256Hex(body) payloadHash = actualHash
} else if !strings.EqualFold(payloadHash, actualHash) && !strings.EqualFold(payloadHash, "UNSIGNED-PAYLOAD") {
// Заголовок заявлен, но не совпадает с фактическим хэшем тела: клиент
// не должен иметь возможность подменить тело под подписанным заголовком.
return errors.New("X-Amz-Content-Sha256 does not match body hash")
} }
canonicalRequest, err := buildCanonicalRequest(r, signedHeaders, payloadHash, true) canonicalRequest, err := buildCanonicalRequest(r, signedHeaders, payloadHash, true)