Wrong AWS Signature Version used when uploading to S3

Sharetribe Go Community Edition
1

Hi there,

Do I understand correctly that Sharetribe Go still uses AWS Signature Version 2 to authorize when trying to upload images, instead of the (in all AWS regions) required Signature Version 4?

400 (Bad Request) : “The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256.”

According to Amazons website, Signature Version 2 is no longer used for S3. Does this mean that Sharetribe Go S3 upload will never function in it’s current state?

https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html
https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-post-example.html

Greetings, Bianca

2

I had the same problem and managed to fix it using an other AWS region for my S3 buckets (eu-west-1 instead of eu-west-3).

But it seems that my fix is only temporary because “After June 24, 2019, Amazon S3 will only accept API requests that are signed using Signature Version 4”.

See below :
https://docs.aws.amazon.com/AmazonS3/latest/dev/auth-request-sig-v2.html

As I am not a developper, I am wondering if someone knows how to change the signature ?

Thanks a lot.

3

Thanks a lot for reporting!

Indeed, Go uses an old signature however as long as you rely on an older S3 region (launched before 2014, such as us-east-1, eu-west-1), that will work smoothly.

We’ll most likely release an update for this in the future (and we appreciate contributions!) however I don’t have any timeline to share.

See also discussion at https://github.com/sharetribe/sharetribe/issues/3983

1 Like