MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-14 08:15:01 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #144 from harshavardhana/pr_out_verify_both_x_amz_date_and_date_header_before_discarding_request

Browse Source
This commit is contained in:
Harshavardhana 2015-02-08 02:39:03 -08:00
commit b2724b80c1
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/utils/crypto/signers/signers.go
View File

@ -34,8 +34,11 @@ func SignRequest(user config.User, req *http.Request) {
// This package implements verification side of Object API Signature request // This package implements verification side of Object API Signature request
func ValidateRequest(user config.User, req *http.Request) (bool, error) { func ValidateRequest(user config.User, req *http.Request) (bool, error) {
if date := req.Header.Get("Date"); date == "" { // Verify if date headers are set, if not reject the request
return false, fmt.Errorf("Date should be set") if req.Header.Get("x-amz-date") == "" {
if req.Header.Get("Date") == "" {
return false, fmt.Errorf("Date should be set")
}
} }
hm := hmac.New(sha1.New, []byte(user.SecretKey)) hm := hmac.New(sha1.New, []byte(user.SecretKey))
ss := getStringToSign(req) ss := getStringToSign(req)
@ -48,9 +51,9 @@ func ValidateRequest(user config.User, req *http.Request) (bool, error) {
encoder.Close() encoder.Close()
// DEBUG // DEBUG
// fmt.Println("Request header sent: ", req.Header.Get("Authorization")) //fmt.Println("Request header sent: ", req.Header.Get("Authorization"))
// fmt.Println("Header calculated: ", authHeader.String()) //fmt.Println("Header calculated: ", authHeader.String())
// fmt.Printf("%q : %x", ss, ss) //fmt.Printf("%q : %x", ss, ss)
if req.Header.Get("Authorization") != authHeader.String() { if req.Header.Get("Authorization") != authHeader.String() {
return false, fmt.Errorf("Authorization header mismatch") return false, fmt.Errorf("Authorization header mismatch")
} }