使用GuzzleHttp遵循重定向到预先签订S3 URL时，遇到了“SignatureDoesNotMatch”

Question

I am consuming an API which receives a POST request with some parameters and uses them to generate a file in S3. This API returns a 303 redirect response with Location: set to the signed URL to access the S3 file.

This works file when accessing the API via eg Postman however when accessing it via GuzzleHttp (v7.4) it fails with error SignatureDoesNotMatch .

While debugging I have used code:

$client = new Client([
   'allow_redirects' => true,
   'on_stats' => function (TransferStats $stats) {
        var_dump($stats->getEffectiveUri());
    }
]);

$client->post('https://api.example.com', [
   'json' => [ ... ]
]);

Doing this I have confirmed that the URL is correct and copy/pasting the exact url that is accessed actually works. However using GuzzleHttp it does not work at all.

Answer 1

The issue turned out to be that when Guzzle follows redirects, it retains most of the original request headers. However the Amazon computed signature also validates the signature against (at least some of) the headers. The offending header was the Content-Type header which was still sent even though the request no longer had any content.

To fix this I created a new Guzzle middleware:

use Psr\Http\Message\RequestInterface;

class RemoveContentType {

    public function __invoke(callable $handler) {
        return function (RequestInterface $request, array $options) use ($handler) {
            if ($request->getHeaderLine('Content-Type')
                && $request->getBody()->getSize() === 0) {
                return $handler($request->withoutHeader('Content-Type'), $options);
            }

            return $handler($request, $options);
        };
    }
}

this would remove the content type from a request which has an empty body.

I then modified my code to use this middleware:

$stack = HandlerStack::create();
$stack->push(new RemoveContentType ());
$client = new Client([
   'handler' => $stack,
   'allow_redirects' => true,
]);

$client->post('https://api.example.com', [
   'json' => [ ... ]
]);

This finally solved my issue.