Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect AWS signature for multipart/form-data #8180

Open
lephuongbg opened this issue Mar 16, 2020 · 11 comments · May be fixed by postmanlabs/postman-runtime#1120
Open

Incorrect AWS signature for multipart/form-data #8180

lephuongbg opened this issue Mar 16, 2020 · 11 comments · May be fixed by postmanlabs/postman-runtime#1120

Comments

@lephuongbg
Copy link

Describe the bug
Currently uploading file with content-type: multipart/form-data to an endpoint using AWS signature v4 doesn't work due to wrong signature being calculated.

To Reproduce
Steps to reproduce the behavior:

  1. Create a request with AWS signature v4 auth
  2. Set body to "form-data"
  3. Add any file to the body
  4. Click "Send"

Expected behavior
The request should succeed.

Current behavior
Request was rejected with "The request signature we calculated does not match the signature you provided."

App information (please complete the following information):

  • App Type: Native App
  • Postman Version: 7.20.0
  • OS: Ubuntu
@mansidoshi
Copy link

I too am facing the same issue. Any leads would be appreciated.
Thanks

@saswatds saswatds added this to Pending triage in Runtime Triage and Development via automation Jul 21, 2020
@bruno-xo7
Copy link

Same in 7.31.1.

I created a client of my own to be able to work. So I had to use the AWS signature calculation and use a crypto library, CryptoJS. I encountered the following problem which could be the same as Postman's one. The CryptoJS library only takes a string as input and not a Buffer, so an implicit .toString() is made to utf8 which makes the signature invalid.

@Envek
Copy link

Envek commented Feb 1, 2021

Same here. Can't POST multipart/form-data to Lambda function behind API Gateway.

It looks like that currently authorization of form data requests left unimplemented in the assumption that it is only used to do uploads directly to S3. See the relevant comment in the source code here: https://github.com/postmanlabs/postman-runtime/blob/451e9aa3ce563b6ae9529633151d4f934cdba9e0/lib/authorizer/aws4.js#L74-L76

But in my case, I want to post form data to API gateway, which is configured to bypass such payload to my Lambda function as is (with multipart/form-data specified as a binary media type).

Maybe it is better to implement signature in the same way as for raw body type to cover at least this use case for the time being?

@BwL1289
Copy link

BwL1289 commented Feb 26, 2021

commenting to track this

@ankit-zibo
Copy link

Following

@ankit-zibo
Copy link

I am also facing the same issue while calling an API with aws_auth using postman latest Version 8.6.1 (8.6.1). Trying to upload multiple files but getting this invalid signature error.

@Envek
Copy link

Envek commented Jun 10, 2021

I was able to set up HTTPie console utility for multipart request signing and switched to it for the time being:

# Install HTTPie with required plugins for AWS request signing
pip install git+https://github.com/Envek/aws-requests-auth@fix/multipart-requests
pip install httpie httpie-aws-authv4

# Make multipart requests like this:
http --auth-type aws4 --auth REDACTED.execute-api.us-west-2.amazonaws.com \
     --multipart POST http://example.com/test field=value

See https://github.com/aidan-/httpie-aws-authv4/issues/10 for details.

@bfoura
Copy link

bfoura commented Jun 2, 2022

We are also facing this issue with Postman. Any plan to solve this issue ?

@kim-mysa
Copy link

Following

@joseph-max-coalfire
Copy link

joseph-max-coalfire commented Feb 3, 2023

Any updates on this? This has been open for two nearly three years, and has been a longstanding issue even before then

@sagar-punchh
Copy link

It took me so much time to figure out that the issue is with postman. I was continuously debugging my API setup as the request was giving signature mismatch error.

Any plan to solve this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging a pull request may close this issue.