MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 12:52:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

Do not reply on ignoredHeaders for server, rely on SignedHeaders sent as part of Authorization header

Browse Source
This commit is contained in:
Harshavardhana
2015-07-10 17:21:53 -07:00
parent 538572ca91
commit 97d4a27c7e
3 changed files with 29 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/server/api/bucket-handlers.go
View File

@@ -405,7 +405,8 @@ func (api Minio) HeadBucketHandler(w http.ResponseWriter, req *http.Request) {
case nil:
writeSuccessResponse(w, acceptsContentType)
case donut.SignatureDoesNotMatch:
writeErrorResponse(w, req, SignatureDoesNotMatch, acceptsContentType, req.URL.Path)
error := getErrorCode(SignatureDoesNotMatch)
w.WriteHeader(error.HTTPStatusCode)
case donut.BucketNotFound:
error := getErrorCode(NoSuchBucket)
w.WriteHeader(error.HTTPStatusCode)

4
pkg/server/api/generic-handlers.go
View File

@@ -45,7 +45,7 @@ const (
)
func parseDate(req *http.Request) (time.Time, error) {
amzDate := req.Header.Get("x-amz-date")
amzDate := req.Header.Get(http.CanonicalHeaderKey("x-amz-date"))
switch {
case amzDate != "":
if _, err := time.Parse(time.RFC1123, amzDate); err == nil {
@@ -97,7 +97,7 @@ func (h timeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
acceptsContentType := getContentType(r)
// Verify if date headers are set, if not reject the request
if r.Header.Get("Authorization") != "" {
if r.Header.Get("x-amz-date") == "" && r.Header.Get("Date") == "" {
if r.Header.Get(http.CanonicalHeaderKey("x-amz-date")) == "" && r.Header.Get("Date") == "" {
// there is no way to knowing if this is a valid request, could be a attack reject such clients
writeErrorResponse(w, r, RequestTimeTooSkewed, acceptsContentType, r.URL.Path)
return