29 Jun
2023
29 Jun
'23
1:46 p.m.
Hi,
I tried to generate a presigned url using SDK PHP, but it doesn't work. (I also tried
to use boto3 with the same configures and the url works normally)
Here is my php code:
<?php
require 'aws-autoloader.php';
use Aws\S3\S3Client;
use Aws\Exception\AwsException;
$s3Client = new Aws\S3\S3Client([
'version' => '2006-03-01',
'region' => 'us-east-1',
'signature_version' => 'v4',
'use_path_style_endpoint' => true,
'endpoint' => 'http://hn.ss.bfcplatform.vn',
'credentials' => [
'key' => 'DNMZAFE6G2PP8H9P05UU',
'secret' => 'XXX',
]
]);
$cmd = $s3Client->getCommand('PutObject', [
'Bucket' => 'huynnp-testbucket1',
'Key' => 'testfile.txt',
]);
$request = $s3Client->createPresignedRequest($cmd, '+60 minutes'); // Set the
expiration time as desired
$presignedUrl = (string)$request->getUri();
echo "$presignedUrl";
?>
and then:
curl -X PUT -T testfile.txt `php s3.php`
<?xml version="1.0"
encoding="UTF-8"?><Error><Code>AccessDenied</Code><RequestId>tx00000b7bb3b2deb6a6ef2-00649d5ebd-d1d50041-hn-1</RequestId><HostId>d1d50041-hn-1-hn</HostId></Error>
I enable the debug_rgw and what I can see is really strange. the domain has been added
:8084, so it make "canonical request hash" and "signature" between
client and server unmatched. I can't explain why does this happens
2023-06-29T17:10:46.880+0700 7f26014b0700 10 v4 credential format =
DNMZAFE6G2PP8H9P05UU/20230629/us-east-1/s3/aws4_request
2023-06-29T17:10:46.880+0700 7f26014b0700 10 access key id = DNMZAFE6G2PP8H9P05UU
2023-06-29T17:10:46.880+0700 7f26014b0700 10 credential scope =
20230629/us-east-1/s3/aws4_request
2023-06-29T17:10:46.880+0700 7f26014b0700 10 req 15647562574720867919 1000005ns canonical
headers format = host:hn.ss.bfcplatform.vn:8084
2023-06-29T17:10:46.880+0700 7f26014b0700 10 payload request hash = UNSIGNED-PAYLOAD
2023-06-29T17:10:46.880+0700 7f26014b0700 10 canonical request = PUT
/huynnp-testbucket1/testfile.txt
X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=DNMZAFE6G2PP8H9P05UU%2F20230629%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230629T101046Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host
host:hn.ss.bfcplatform.vn:8084
host
UNSIGNED-PAYLOAD
2023-06-29T17:10:46.880+0700 7f26014b0700 10 canonical request hash =
d28e6c3104aff99e9928f902892627d2b284a29d489fbb034ed5c90aa21c566a
2023-06-29T17:10:46.880+0700 7f26014b0700 10 string to sign = AWS4-HMAC-SHA256
20230629T101046Z
20230629/us-east-1/s3/aws4_request
d28e6c3104aff99e9928f902892627d2b284a29d489fbb034ed5c90aa21c566a
29 Jun
29 Jun
8:38 p.m.
On Thu, Jun 29, 2023 at 10:46:16AM -0000, Huy Nguyen wrote:
Hi,
I tried to generate a presigned url using SDK PHP, but it doesn't
work. (I also tried to use boto3 with the same configures and the url
works normally)
Do you have some sort of load-balancer in the setup? Either
HAProxy,
Nginx, or something else.
If the port number isn't in the PHP script's output, by deduction it
must be coming from somewhere else. As a bug or misconfiguration.
--
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail : robbat2(a)gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
30 Jun
30 Jun
4:21 a.m.
Thanks for your reply,
Yes, my setup is like the following:
RGWs (port 8084) -> Nginx (80, 443)
So this why it make me confuse when :8084 appear with the domain.
And this behavior only occurs with PHP's generated url, not in Boto3
9:37 a.m.
On Fri, Jun 30, 2023 at 01:21:57AM -0000, Huy Nguyen wrote:
Thanks for your reply,
Yes, my setup is like the following:
RGWs (port 8084) -> Nginx (80, 443)
So this why it make me confuse when :8084 appear with the domain.
And this behavior only occurs with PHP's generated url, not in Boto3
Put
tcpdump or something else between nginx & RGW and capture the
transaction when using Boto3 vs PHP.
I'm relatively sure it's nginx adding it for you.
--
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail : robbat2(a)gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
3 Jul
3 Jul
7:42 a.m.
Thanks for your support,
Using tcpdump and wireshark, I can see both boto3 and PHP transactions have this field:
Host: hn.ss.bfcplatform.vn\r\n
Which does not contain 8084, so I'm still confused about how it appeared =)
But anyway, this configuration in nginx was solved the problem:
proxy_set_header X-Forwarded-Port 443;
322
days inactive
326
days old
4 comments
2 participants
participants (2)
-
Huy Nguyen -
Robin H. Johnson