chore: update illegal v4a headers

aws · Feb 5, 2025 · 9ae71fd · 9ae71fd
1 parent cc0b21d
commit 9ae71fd
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 4 deletions.
diff --git a/.changes/nextrelease/sigv4a-headers.json b/.changes/nextrelease/sigv4a-headers.json
@@ -0,0 +1,7 @@
+[
+  {
+    "type": "enhancement",
+    "category": "Signature",
+    "description": "Adds `transfer-encoding` to list of headers to be removed prior to sigv4a signing"
+  }
+]
diff --git a/src/Signature/SignatureV4.php b/src/Signature/SignatureV4.php
@@ -469,16 +469,17 @@ protected function createCRTStaticCredentialsProvider($credentials)
 
     private function removeIllegalV4aHeaders(&$request)
     {
-        $illegalV4aHeaders = [
+        static $illegalV4aHeaders = [
             self::AMZ_CONTENT_SHA256_HEADER,
-            "aws-sdk-invocation-id",
-            "aws-sdk-retry",
+            'aws-sdk-invocation-id',
+            'aws-sdk-retry',
             'x-amz-region-set',
+            'transfer-encoding'
         ];
         $storedHeaders = [];
 
         foreach ($illegalV4aHeaders as $header) {
-            if ($request->hasHeader($header)){
+            if ($request->hasHeader($header)) {
                 $storedHeaders[$header] = $request->getHeader($header);
                 $request = $request->withoutHeader($header);
             }

diff --git a/tests/Signature/SignatureV4Test.php b/tests/Signature/SignatureV4Test.php
@@ -535,4 +535,29 @@ public function testSignsRequests($req, $sreq, $creq)
         $this->assertEquals($creq, $ctx['creq']);
         $this->assertSame($sreq, Psr7\Message::toString($signature->signRequest($request, $credentials)));
     }
+
+    public function testRemovesIllegalV4aHeadersBeforeSigning()
+    {
+        if (!extension_loaded('awscrt')) {
+            $this->markTestSkipped();
+        }
+
+        static $headers = [
+            'X-Amz-Content-Sha256' => 'blah',
+            'aws-sdk-invocation-id' => 1,
+            'aws-sdk-retry' => 'foo',
+            'transfer-encoding' => 'chunked'
+        ];
+        $sig = new SignatureV4('foo', 'bar', ['use_v4a' => true]);
+        $creds = new Credentials('a', 'b');
+        $req = new Request('PUT', 'http://foo.com', $headers);
+        $signed = $sig->signRequest($req, $creds, 'foo');
+        $signedHeaders = $signed->getHeaderLine('Authorization');
+
+        foreach ($headers as $key => $value) {
+            $this->assertStringNotContainsString($key, $signedHeaders);
+            $this->assertTrue($req->hasHeader($key));
+            $this->assertEquals($value, $req->getHeaderLine($key));
+        }
+    }
 }