I cant use Content-MD5 Header on presigned URL for command with putObject

[rgarcia-martin]

Im trying to use a presigned url with that code:

$cmd = $s3Client->getCommand("PutObject", array(
            "Bucket" => $bucket["bucket"],
            "Key" => "prueba",
        ));
$request = $s3Client->createPresignedRequest($cmd, "+10 minutes");
$presignedUrl = (string) $request->getUri();

The URL generated is send to a mobile app that will upload the file. I need the mobile app check that the file is correctly uploaded using the Content-MD5 Header.

All time im trying to use this header, amazon returns AccessDenied with that message:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>AccessDenied</Code>
    <Message>There were headers present in the request which were not signed</Message>
    <HeadersNotSigned>content-md5</HeadersNotSigned>
</Error>

=================

I tried the following methods to add the Header to the presign process without results:

• Add "Content-MD5" to params for initializate de S3Client
• Add "Content-MD5" to params for getCommand function: getCommand("PutObject", ["Bucket" => "asdfsd", "Key" => "asdfsdf", "Content-MD5" => "sadfasdf"]
• Create an Middleware::mapRequest for add the Header in Builder step:

$middelware = Middleware::mapRequest(function(RequestInterface $request){
            var_dump("map-request");
            var_dump($request);

            $r2 = $request->withHeader("Content-MD5", "FB1E00AB39252B6C3EBBFC14C53C636D");

            var_dump($r2);
            var_dump("end map-request");

            return $r2;
        });

        $list = $cmd->getHandlerList();
        $list->appendBuild($middelware);

• Create an Middleware::mapRequest for add the Content-MD5 in the query params:

$middelware = Middleware::mapRequest(function(RequestInterface $request){
            var_dump("map-request");
            var_dump($request);

            $query = $request->getUri()->getQuery();
            if(!empty($query)){
                $query .= "&";
            }

            $query .= "Content-MD5=FB1E00AB39252B6C3EBBFC14C53C636D";

            $uri2 = $request->getUri()->withQuery($query);
            $r2 = $request->withUri($uri2);

            var_dump($r2);
            var_dump("end map-request");

            return $r2;
        });

        $list = $cmd->getHandlerList();
        $list->appendBuild($middelware);

But ALL TIME the $s3Client->createPresignedRequest($cmd, "+10 minutes") returns an RequestInterface without Content-MD5 Header signed and amazon return Error...

Thanks You for Helping! :D

[kstich]

Is it possible for you to use the 'ContentSHA256' option with a provided sha256 hash instead of an md5? This would automatically be picked up and signed by the ApplyChecksumMiddleware:

$cmd = $s3Client->getCommand("PutObject", array(
            "Bucket" => $bucket["bucket"],
            "Key" => "prueba",
            "ContentSHA256" => $objectSha256
        ));

Otherwise, you'll need to provide 'X-Amz-Content-Md5' as the header name instead of just 'Content-MD5' for ->withHeader in your first mapRequest middleware. If you create a custom Middleware instead of using mapRequest, you'll have access to both the $command and $request.

[rgarcia-martin]

Thanks @kstich , i will try that options but... What do you think about the posibility of use a header that fill the mobile app when upload the file without sign the content (the server generate the URL and send it to the mobile app without know any info from the file, then the mobile app launch the PUT request)?

Thank you again! :D

[kstich]

You will have to sign the checksum header that's being passed in some way. This can either be done as above (passing the checksum to the server to generate the URL for uploading) or by fully signing the URL on the app.

[kstich]

Closing due to lack of reply. Please let us know here if there's any new information.

[bap840]

@kstich, I had the same problem (but with a multipart upload) and I've modified my code to pass in the sha256 checksum via "ContentSHA256" instead of as a Content-MD5 header as you suggested, however X-Amz-Content-Sha256 parameter seems to be ignored, no matter what I pass in it goes through.. here is a recent request I tried

https://s3-us-west-1.amazonaws.com/files.team.eon.plus/dev/10138/12752/file.3.json?uploadId=.DniEZhPWhy2hG6w5MtB.YhNQ0uSn4wRurfSmjvfmIEICyxvb.M4OIRsQHXs6hWhTuV8.cKy8KRFUGqxu10zby2uLOs_v868YMJq1dgMma2tZNvAkfGwV.0wHxNIJt3_&partNumber=1&X-Amz-Content-Sha256=56122b952b633eb3422e687c04deba894a1334220fed1ad58c21553d2459691e-DUMMY&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJ3VMBV5CC2RKTACQ%2F20171101%2Fus-west-1%2Fs3%2Faws4_request&X-Amz-Date=20171101T234004Z&X-Amz-SignedHeaders=host&X-Amz-Expires=3600&X-Amz-Signature=b19484a3bd21fb0aab1abd6415f16213ff1bfc4c8bb4031e2679b0ddfe5929d1

You can see I appened "-DUMMY" to the end of my checksum but it still went through... before if I tried the same thing with my Content-MD5 header it would be rejected. Any help would be appreciated!

(btw I have the same problem now if I try to send x-amz-content-md5 as part of the query string ..it's also ignored and goes through with any value)

[imaimai86]

Any updates on this issue will be appreciated

[MNV]

I have the same issue with checksum providing ContentSha256 param in command for creating pre-signed URL. I think the problem is in getPresignedPayload() method (https://github.com/jeskew/aws-sdk-php/blob/4e29e28494f8dc69c2ae1b34a0a658e8ed9537fe/src/Signature/S3SignatureV4.php#L53) which always returns UNSIGNED-PAYLOAD that doesn't match real body content of the uploading file.