Replace typed range/ifMatch with generic header map on PresignedUrlDownloadRequest#7062
Draft
jencymaryjoseph wants to merge 3 commits into
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Signed header-location fields (Range, If-Match, If-None-Match, SSE-C, etc.) are signed into a presigned URL's signature but their values are not stored in the URL — only their names appear in X-Amz-SignedHeaders. The downloader must replay those exact header values or S3 returns a 403 signature mismatch.
This is the same behavior in V1, the
PresignedUrlDownloadRequestrequired the caller to manually set any headers that were signed at URL generation time. If a header was signed but not replayed at download time, S3 rejected the request with SignatureDoesNotMatch. The SDK cannot automatically recover from this because the header values are not stored anywhere in the URL — only the header names are listed in X-Amz-SignedHeaders. The caller must know what values were signed and provide them.v2
PresignedUrlDownloadRequestonly exposed range() and ifMatch() [these were also needed to be set by SDK for the multipart downloads] with no way to supply other signed headers (SSE-C, If-None-Match, etc.).Modifications
Added putHeader(String, String) / headers(Map<String, List>) after RequestOverrideConfiguration's header idiom in the V2 SDK. We considered extending
PresignedUrlDownloadRequestfrom S3Request or SdkRequest so that overrideConfiguration() would be available, but this was not viable because S3Request.overrideConfiguration() exposes signer, credentials, and endpoint overrides that are incompatible with presigned URL execution (which uses a NoOpSigner and relies solely on the URL's embedded signature). Extending S3Request would pull in sdkFields(), marshalling traits, and the full request pipeline — none of which apply to a presigned URL download.Testing
Screenshots (if appropriate)
Types of changes
Checklist
mvn installsucceedsscripts/new-changescript and following the instructions. Commit the new file created by the script in.changes/next-releasewith your changes.License