b4e2cca204
* s3api: remove redundant auth verification in getRequestDataReader The handlers PutObjectHandler and PutObjectPartHandler are already wrapped with s3a.iam.Auth() middleware which performs signature verification via authRequest() before the handler is invoked. The signature verification for authTypeSignedV2, authTypePresignedV2, authTypePresigned, and authTypeSigned in getRequestDataReader was therefore redundant. The newChunkedReader() call for streaming auth types is kept as it's needed to parse the chunked transfer encoding and extract the actual data. Fixes #7683 * simplify switch to if statement for single condition
36 lines
1.1 KiB
Go
36 lines
1.1 KiB
Go
package s3api
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
// getRequestDataReader returns the appropriate reader for the request body.
|
|
// When IAM is disabled, it still processes chunked transfer encoding for
|
|
// authTypeStreamingUnsigned to strip checksum headers and extract the actual data.
|
|
// This fixes issues where chunked data with checksums would be stored incorrectly
|
|
// when IAM is not enabled.
|
|
func getRequestDataReader(s3a *S3ApiServer, r *http.Request) (io.ReadCloser, s3err.ErrorCode) {
|
|
var s3ErrCode s3err.ErrorCode
|
|
dataReader := r.Body
|
|
rAuthType := getRequestAuthType(r)
|
|
if s3a.iam.isEnabled() {
|
|
if rAuthType == authTypeStreamingSigned || rAuthType == authTypeStreamingUnsigned {
|
|
dataReader, s3ErrCode = s3a.iam.newChunkedReader(r)
|
|
}
|
|
} else {
|
|
switch rAuthType {
|
|
case authTypeStreamingSigned:
|
|
s3ErrCode = s3err.ErrAuthNotSetup
|
|
case authTypeStreamingUnsigned:
|
|
// Even when IAM is disabled, we still need to handle chunked transfer encoding
|
|
// to strip checksum headers and process the data correctly
|
|
dataReader, s3ErrCode = s3a.iam.newChunkedReader(r)
|
|
}
|
|
}
|
|
|
|
return dataReader, s3ErrCode
|
|
}
|