Documentation
¶
Overview ¶
Package sigparse extracts identity and routing information from AWS request signatures without ever verifying them. doze-aws is a local emulator with a fixed identity, so a signature's only value is what it *names*: the access key, and — for SigV4 — the region and service the request was signed for (which the gateway uses to route a shared endpoint).
Both signature generations are understood, in both placements:
SigV4 header: Authorization: AWS4-HMAC-SHA256 Credential=AKID/20130524/us-east-1/s3/aws4_request, SignedHeaders=..., Signature=... SigV4 presigned: ?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKID%2F20130524%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=...&X-Amz-Expires=... SigV2 header: Authorization: AWS AKID:Base64Signature SigV2 presigned: ?AWSAccessKeyId=AKID&Signature=...&Expires=1141889120
The one check that IS enforced is presigned-URL expiry (both forms): stale presigned URLs are a real, cheap-to-catch application bug.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Scope ¶
type Scope struct {
AccessKeyID string
Date string // SigV4 credential-scope date (YYYYMMDD); empty for SigV2
Region string // SigV4 only
Service string // SigV4 signing name, e.g. "s3", "events"; empty for SigV2
Version int // 2 or 4
Presigned bool
}
Scope identifies who a request claims to be from and, for SigV4, what it was signed for.
func Parse ¶
Parse extracts the signature scope from r, trying the SigV4 header, the SigV2 header, then the two presigned query forms. ok is false when the request carries no recognizable AWS signature (anonymous requests are fine — callers treat them like any other).
func ParseAuthorization ¶
ParseAuthorization parses an Authorization header in either generation.
Source Files