aws-sigv4 failing to calculate the right signature when using "content-type: multipart/form-data" about curl HOT 7 OPEN

Aha, ok. Thanks for clarifying.

from curl.

fails to sign properly when given Content-Type: multipart/form-data.

So why do you?

When sending a multipart formpost, the Content-Type header also needs a boundary string set (and curl needs to know it) and your provided header does not so curl is not able to produce a proper POST. You broke curl by providing a broken header.

update: curl actually can survive the situation and still do a formpost with a boundary so it does not exactly explain the error. Even though the original question why you would use this command line remains.

from curl.

So the same error occurs whether or not I give it the -H "Content-Type: multipart/form-data.
I left it there as this was how we received the bug internally.

from curl.

This confuses me. Your report says

When using the curl command with only a single file and without Content-Type: multipart/form-data everything works as expected

Isn't that quite the opposite of what you just said here?

from curl.

I think I might need to clarify then. :)
Whenever curl tries to send a request where curl uses the Content-Type: multipart/form-data, then it fails to sign correctly.
So in this case whether it automatically adds it because of -F or if I add it manually, then it fails to sign the message correctly.

Sorry for the confusion. :)

from curl.

I suspect this is because the generated Content-Type: type header used for multipart formposts is not taken into account correctly when the header hash is calculated.

from curl.

For context what we have done previously that worked was:

curl --verbose -X POST "${ENDPOINT}" \
-d "$DATA" \
--user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
--aws-sigv4 "aws:amz:${AWS_REGION}:${SERVICE}" \
--header "x-amz-security-token: $AWS_SESSION_TOKEN"

This has worked fine until we needed to upload multiple files.
Here we end up with Content-Type: application/x-www-form-urlencoded.

from curl.