diff --git a/cmd/api-errors.go b/cmd/api-errors.go index c77190309..ca8800e20 100644 --- a/cmd/api-errors.go +++ b/cmd/api-errors.go @@ -103,6 +103,7 @@ const ( ErrNegativeExpires ErrAuthHeaderEmpty ErrExpiredPresignRequest + ErrRequestNotReadyYet ErrUnsignedHeaders ErrMissingDateHeader ErrInvalidQuerySignatureAlgo @@ -448,6 +449,11 @@ var errorCodeResponse = map[APIErrorCode]APIError{ Description: "Request has expired", HTTPStatusCode: http.StatusForbidden, }, + ErrRequestNotReadyYet: { + Code: "AccessDenied", + Description: "Request is not valid yet", + HTTPStatusCode: http.StatusForbidden, + }, // FIXME: Actual XML error response also contains the header which missed in lsit of signed header parameters. ErrUnsignedHeaders: { Code: "AccessDenied", diff --git a/cmd/signature-v4.go b/cmd/signature-v4.go index 4edac7afd..a8e8af845 100644 --- a/cmd/signature-v4.go +++ b/cmd/signature-v4.go @@ -246,6 +246,10 @@ func doesPresignedSignatureMatch(hashedPayload string, r *http.Request, validate query.Set("X-Amz-Algorithm", signV4Algorithm) + if pSignValues.Date.After(time.Now().UTC()) { + return ErrRequestNotReadyYet + } + if time.Now().UTC().Sub(pSignValues.Date) > time.Duration(pSignValues.Expires) { return ErrExpiredPresignRequest }