Solved: Server-side modification of header seems to cause ...

kofuk · 01-04-2024 03:35 AM

I got SignatureDoesNotMatch error calling Cloud Storage's XML API using aws-sdk-go-v2.
SignatureDoesNotMatch is an error occurs when signature in Authorization header is not valid.
I think the cause of the issue is that Google's internal system modifies header `accept-encoding: identity` to `accept-encoding: identity,gzip(gfe)`.

I found that modification because the error response contains the headers to calculate the signature on the Google server.
I compared these to the headers which I sent, and found a difference from the original one.

Also, I sent a request without including accept-encoding to signature calculation, and it succeeded.
So, the SignatureDoesNotMatch error seems to be caused by server-side modification of accept-encoding value.

I can calculate signature without `accept-encoding`, but it requires some hacks on aws-sdk-go-v2, so I would not like to use this solution.

Question:
- Why was `gzip(gfe)` added despite that I have not sent?
- Can I avoid the header value to be changed?

christianpaula

Hi @kofuk,

Welcome to Google Cloud Community!

You're encountering a "SignatureDoesNotMatch" error when using aws-sdk-go-v2 with Cloud Storage XML API, likely due to server-side modification of the accept-encoding header.

Solutions:

Exclude `accept-encoding` from signature calculation: preferred method; ensure consistent signatures regardless of header modifications. Check aws-sdk-go-v2 documentation or consider custom middleware/code modifications.
Set `accept-encoding` to `identity`, gzip in requests: aligns with modification to potentially avoid mismatches.

Further Assistance:

For specific guidance, contact Google Cloud Support or relevant forums, providing code snippets and SDK details.

Insights:

gzip (gfe) addition might be for optimizations, security, or load balancing.

By implementing these solutions, you should resolve the error.

View solution in original post

christianpaula