class AWS::SignatureV4

Overview

Implements AWS Signature Version 4 for both Authorization-header signing (#sign) and query-string presigning (#presign).

Request paths are signed verbatim. Callers are responsible for percent-encoding paths the way the service expects them on the wire, which for S3 means encoding each key segment exactly once.

Defined in:

signature_v4.cr

Constant Summary

UNSIGNABLE_HEADERS = Set {"authorization", "cache-control", "connection", "content-length", "expect", "from", "keep-alive", "max-forwards", "pragma", "referer", "te", "trailer", "transfer-encoding", "upgrade", "user-agent", "x-amzn-trace-id"}

Headers that are never signed because proxies and HTTP clients commonly add, remove, or rewrite them in transit. Everything else on the request is signed.

Constructors

Instance Method Summary

Constructor Detail

def self.new(service : String, region : String, access_key_id : String, secret_access_key : String, session_token : String | Nil = nil) #

[View source]

Instance Method Detail

def presign(method : String, uri : URI, headers : HTTP::Headers = HTTP::Headers.new, expires_in : Time::Span = 10.minutes, now : Time = Time.utc) : URI #

Returns a copy of uri carrying the query parameters that authorize an unauthenticated client to perform method on it until expires_in has elapsed. Any query parameters already on uri are preserved and signed.

Every header in headers becomes part of the signature, so the client using the URL must send them exactly as given. Host is derived from uri unless supplied.


[View source]
def region : String #

[View source]
def service : String #

[View source]
def sign(request : HTTP::Request, now : Time = Time.utc) : Nil #

Signs request in place by setting the X-Amz-Date, X-Amz-Content-Sha256, and Authorization headers (and X-Amz-Security-Token when a session token is configured).

The request must already carry the Host header it will be sent with. If X-Amz-Content-Sha256 is already set (for example to UNSIGNED-PAYLOAD), it is signed as given instead of hashing the body, so a non-rewindable body can be streamed to services that allow it.


[View source]