octoturge/MCMapper-Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix worker MinIO endpoint to omit default port from signed Host header

Browse Source 
s3.octoturge.com normalizes an explicit :443/:80 out of the Host header
before validating SigV4, so including it caused SignatureDoesNotMatch
even with correct credentials.
This commit is contained in:
Iwo Strzeboński
2026-08-10 08:39:43 +02:00
parent bd4ad00159
commit 394ec50ae5
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
worker/src/main.rs
+13 -5
View File
@@ -24,11 +24,19 @@ async fn main() -> anyhow::Result<()> {
} else { } else {
"http" "http"
}; };
let minio_endpoint = format!( let minio_host = std::env::var("MINIO_ENDPOINT").unwrap_or_else(|_| "minio".into());
"{minio_scheme}://{}:{}", let minio_port = std::env::var("MINIO_PORT").unwrap_or_else(|_| "9000".into());
std::env::var("MINIO_ENDPOINT").unwrap_or_else(|_| "minio".into()), // Omit the port when it's the scheme's default — an explicit ":443"/":80" in the endpoint
std::env::var("MINIO_PORT").unwrap_or_else(|_| "9000".into()), // gets baked into the SigV4-signed Host header, and some S3-compatible gateways (confirmed
); // against s3.octoturge.com) normalize the port away before validating the signature,
// producing SignatureDoesNotMatch even with a correct access/secret key.
let is_default_port = (minio_scheme == "https" && minio_port == "443")
|| (minio_scheme == "http" && minio_port == "80");
let minio_endpoint = if is_default_port {
format!("{minio_scheme}://{minio_host}")
} else {
format!("{minio_scheme}://{minio_host}:{minio_port}")
};
let minio_access_key = std::env::var("MINIO_ACCESS_KEY").unwrap_or_else(|_| "mcmapper".into()); let minio_access_key = std::env::var("MINIO_ACCESS_KEY").unwrap_or_else(|_| "mcmapper".into());
let minio_secret_key = let minio_secret_key =
std::env::var("MINIO_SECRET_KEY").unwrap_or_else(|_| "mcmapper-dev-only".into()); std::env::var("MINIO_SECRET_KEY").unwrap_or_else(|_| "mcmapper-dev-only".into());