snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/s3api_auth.go

@@ -0,0 +1,105 @@
+package s3api
+
+import (
+	"net/http"
+	"strings"
+)
+
+// AWS Signature Version '4' constants.
+const (
+	signV4Algorithm = "AWS4-HMAC-SHA256"
+	signV2Algorithm = "AWS"
+	iso8601Format   = "20060102T150405Z"
+	yyyymmdd        = "20060102"
+)
+
+// Verify if request has JWT.
+func isRequestJWT(r *http.Request) bool {
+	return strings.HasPrefix(r.Header.Get("Authorization"), "Bearer")
+}
+
+// Verify if request has AWS Signature Version '4'.
+func isRequestSignatureV4(r *http.Request) bool {
+	return strings.HasPrefix(r.Header.Get("Authorization"), signV4Algorithm)
+}
+
+// Verify if request has AWS Signature Version '2'.
+func isRequestSignatureV2(r *http.Request) bool {
+	return !strings.HasPrefix(r.Header.Get("Authorization"), signV4Algorithm) &&
+		strings.HasPrefix(r.Header.Get("Authorization"), signV2Algorithm)
+}
+
+// Verify if request has AWS PreSign Version '4'.
+func isRequestPresignedSignatureV4(r *http.Request) bool {
+	_, ok := r.URL.Query()["X-Amz-Credential"]
+	return ok
+}
+
+// Verify request has AWS PreSign Version '2'.
+func isRequestPresignedSignatureV2(r *http.Request) bool {
+	_, ok := r.URL.Query()["AWSAccessKeyId"]
+	return ok
+}
+
+// Verify if the request has AWS Streaming Signature Version '4'. This is only valid for 'PUT' operation.
+// Supports both with and without trailer variants:
+// - STREAMING-AWS4-HMAC-SHA256-PAYLOAD (original)
+// - STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (with trailing checksums)
+func isRequestSignStreamingV4(r *http.Request) bool {
+	if r.Method != http.MethodPut {
+		return false
+	}
+	contentSha256 := r.Header.Get("x-amz-content-sha256")
+	return contentSha256 == streamingContentSHA256 || contentSha256 == streamingContentSHA256Trailer
+}
+
+func isRequestUnsignedStreaming(r *http.Request) bool {
+	if r.Method != http.MethodPut {
+		return false
+	}
+	return r.Header.Get("x-amz-content-sha256") == streamingUnsignedPayload
+}
+
+// Authorization type.
+type authType int
+
+// List of all supported auth types.
+const (
+	authTypeUnknown authType = iota
+	authTypeAnonymous
+	authTypePresigned
+	authTypePresignedV2
+	authTypePostPolicy
+	authTypeStreamingSigned
+	authTypeStreamingUnsigned
+	authTypeSigned
+	authTypeSignedV2
+	authTypeJWT
+)
+
+// Get request authentication type.
+func getRequestAuthType(r *http.Request) authType {
+	var authType authType
+
+	if isRequestSignatureV2(r) {
+		authType = authTypeSignedV2
+	} else if isRequestPresignedSignatureV2(r) {
+		authType = authTypePresignedV2
+	} else if isRequestSignStreamingV4(r) {
+		authType = authTypeStreamingSigned
+	} else if isRequestUnsignedStreaming(r) {
+		authType = authTypeStreamingUnsigned
+	} else if isRequestSignatureV4(r) {
+		authType = authTypeSigned
+	} else if isRequestPresignedSignatureV4(r) {
+		authType = authTypePresigned
+	} else if isRequestJWT(r) {
+		authType = authTypeJWT
+	} else if _, ok := r.Header["Authorization"]; !ok {
+		authType = authTypeAnonymous
+	} else {
+		authType = authTypeUnknown
+	}
+
+	return authType
+}