auth

Documentation

Index

• Constants
• func HandleAuth(req *http.Request, store KeyStore, region string, now time.Time) (string, error)
• func RedactURL(u *url.URL) string
• func Sha256HashFromRequest(req *http.Request) (*[32]byte, error)
• type AuthenticatedHandler
• type AuthenticatedHandlerFunc
  • func (f AuthenticatedHandlerFunc) ServeHTTP(w http.ResponseWriter, r *http.Request, accessKeyID *string)
• type KeyStore
• type SecretAccessKey

Constants

const (
	// The algorithm that was used to calculate the signature.
	HeaderAuthorization = "Authorization"

	// The payload integrity mechanism that was used.
	HeaderXAMZContentSHA256 = "X-Amz-Content-Sha256"

	// The date and time when the signature was calculated. Takes precedence
	// over HeaderDate.
	HeaderXAMZDate = "X-Amz-Date"

	// HeaderXAMZDecodedContentLength contains the decoded content length of an
	// aws-chunked encoded request.
	HeaderXAMZDecodedContentLength = "X-Amz-Decoded-Content-Length"

	// HeaderXAMZTrailer contains the expected headers of the payload trailer
	HeaderXAMZTrailer = "X-Amz-Trailer"

	// HeaderXAMZTrailerSignature carries the signature over the trailer
	// block on the signed *-TRAILER variants.
	HeaderXAMZTrailerSignature = "X-Amz-Trailer-Signature"

	// HeaderDate is the standard HTTP "Date" header. It is used if
	// HeaderXAMZDate is not present.
	HeaderDate = "Date"
)

The following constants define HTTP header names used in the signing process.

const (
	AuthorizationAWS4HMACSHA256 = "AWS4-HMAC-SHA256" // SigV4

	AuthorizationAWS4ECDSAP256SHA256 = "AWS4-ECDSA-P256-SHA256" // SigV4A
)

The following constants define the supported "Authorization" header values

const (
	// Unsigned
	ContentUnsignedPayload                 = "UNSIGNED-PAYLOAD"
	ContentStreamingUnsignedPayloadTrailer = "STREAMING-UNSIGNED-PAYLOAD-TRAILER"

	// v4 signed
	ContentStreamingAWS4HMACSHA256Payload        = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
	ContentStreamingAWS4HMACSHA256PayloadTrailer = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER"

	// v4a signed
	ContentStreamingAWS4ECDSAP256SHA256Payload        = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD"
	ContentStreamingAWS4ECDSAP256SHA256PayloadTrailer = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER"
)

The following constants define the potential values for the "X-Amz-Content-Sha256" header. If the header does not contain one of these sentinel values, the value is to be interpreted as the actual checksum of the payload.

Functions

func HandleAuth

func HandleAuth(req *http.Request, store KeyStore, region string, now time.Time) (string, error)

HandleAuth inspects the request to determine the authentication type, verfies the signature and returns the used access key ID.

- 'now' refers to the current time and is used to verify request timestamps - 'region' is the AWS region the request is targeted to. If the region is an empty string, every region is allowed. Otherwise, authentication fails if the region doesn't match the provided one.

func RedactURL

func RedactURL(u *url.URL) string

RedactURL returns u as a string with secret presigned-URL query parameters redacted for logging. It is safe to call with a nil URL.

func Sha256HashFromRequest

func Sha256HashFromRequest(req *http.Request) (*[32]byte, error)

Sha256HashFromRequest extracts the SHA256 hash of the payload from the request if available. This hash should then be used to verify the integrity of the payload.

Types

type AuthenticatedHandler

type AuthenticatedHandler interface {
	ServeHTTP(w http.ResponseWriter, req *http.Request, accessKeyID *string)
}

AuthenticatedHandler is like http.Handler but includes the access key ID of the authenticated user.

type AuthenticatedHandlerFunc

type AuthenticatedHandlerFunc func(http.ResponseWriter, *http.Request, *string)

AuthenticatedHandlerFunc is an adapter to allow the use of ordinary functions as authenticated handlers. If f is a function with the appropriate signature, authenticatedHandlerFunc(f) is an authenticated handler that calls f.

func (AuthenticatedHandlerFunc) ServeHTTP

func (f AuthenticatedHandlerFunc) ServeHTTP(w http.ResponseWriter, r *http.Request, accessKeyID *string)

ServeHTTP calls f(w, r, accessKeyID).

type KeyStore

type KeyStore interface {
	// LoadSecret loads the secret key for the given access key ID. If the
	// access key wasn't found, the error s3errs.ErrInvalidAccessKeyID must be
	// returned.
	LoadSecret(ctx context.Context, accessKeyID string) (SecretAccessKey, error)
}

KeyStore provides an interface for a secure key store.

type SecretAccessKey

type SecretAccessKey []byte

SecretAccessKey represents a secret access key. It is obtained from a KeyStore by calling LoadSecret and should be cleared after usage.