x-amz-acl Headers not signed
See original GitHub issueI had an issue where all of my requests were coming back with this:
<Error>
<Code>
AccessDenied
</Code>
<Message>
There were headers present in the request which were not signed
</Message>
<HeadersNotSigned>
x-amz-acl
</HeadersNotSigned>
<RequestId>
MyRequestId
</RequestId>
<HostId>
BASE64EncodedHostId=
</HostId>
</Error>
My presigner uses the official ruby aws SDK:
def presign_foo(name)
signer = Aws::S3::Presigner.new
signer.presigned_url(:put_object, bucket: Rails.application.config.s3_root, key: "something_private/#{name}", acl: 'public-read')
end
And it outputs this string:
https://foo-dev.s3.amazonaws.com/something_private/my_filename?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=MyCredentials%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20170118T190154Z&X-Amz-Expires=900&X-Amz-SignedHeaders=host&x-amz-acl=public-read&X-Amz-Signature=MySignature
And here is my react component. getSignedPeopleTargeting calls a route that ends up returning the value from presign_foo.
<S3Uploader
getSignedUrl={this.props.getSignedPeopleTargeting}
/>
Eventually I tracked this down to a line in the s3-uploader that adds the header: https://github.com/odysseyscience/react-s3-uploader/blob/7a26ebc3d0cbfbf3bfb9bec2d0cb28bf147e8b95/s3upload.js#L160
I believe that this header is not needed as I can control the acl in my presign function (tested by making it private). Because all the presigner examples set the acl, can this line be removed? Alternatively, can the if statement be changed to: typeof this.uploadRequestHeaders === 'undefined'?
Issue Analytics
- State:
- Created 7 years ago
- Comments:7 (1 by maintainers)
Top Related StackOverflow Question
For fellow googlers, here’s a quick workaround. Pass the
uploadRequestHeadersprop with{}, and you’ll get no headers attached to the request.For Python devs using Boto3, there is a sample to generate presigned urls in the documentation, but note that the ClientMethod correlates to methods in the S3.Client library. You’ll want to use the put_object string, and include the ACL parameter in the Params object. Hope that saves someone a bunch of time.