SignatureDoesNotMatch for object keys with special characters in cloudserverclient#21
Merged
bert-e merged 5 commits intodevelopment/1.0from Apr 16, 2026
Merged
Conversation
Hello maeldonn,My role is to assist you with the merge of this Available options
Available commands
Status report is not available. |
9d22579 to
78797e4
Compare
Waiting for approvalThe following approvals are needed before I can proceed with the merge:
|
DarkIsDude
approved these changes
Apr 15, 2026
SylvainSenechal
approved these changes
Apr 15, 2026
benzekrimaha
approved these changes
Apr 16, 2026
The Smithy serializer percent-encodes path parameters (spaces → %20), then the SigV4 signer re-encodes them (%20 → %2520) because uriEscapePath defaults to true. This causes SignatureDoesNotMatch for any object key with special characters (spaces, parentheses, !, ', *, +, unicode, etc.). Default signingEscapePath to false in BackbeatRoutesClient, BucketQuotaClient, and ProxyBackbeatApisClient. Issue: CLDSRVCLT-13
78797e4 to
6ca42b5
Compare
francoisferrand
approved these changes
Apr 16, 2026
Contributor
Author
|
/approve |
|
I have successfully merged the changeset of this pull request
Please check the status of the associated issue CLDSRVCLT-13. Goodbye maeldonn. The following options are set: approve |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Object keys containing special characters (spaces,
!,',*,+,parentheses, unicode, etc.) cause
SignatureDoesNotMatcherrors on allbackbeat metadata operations (GetMetadata, PutMetadata, etc.).
The Smithy serializer already percent-encodes path parameters when
building the request URL (e.g., spaces →
%20). Then the SigV4 signerre-encodes the path when computing the canonical URI because
uriEscapePathdefaults totrue, turning%20into%2520. Theserver computes the signature over the single-encoded path (
%20), sothe signatures never match.
Simple alphanumeric keys are unaffected because their encoding is
idempotent.
How to reproduce
Call any backbeat route with a key containing a space:
Fix
Default
signingEscapePathtofalseinBackbeatRoutesClientandProxyBackbeatApisClientconstructors. Thistells the SigV4 signer to skip re-encoding the already-encoded path.
Callers can still override with
signingEscapePath: trueif needed.Issue: CLDSRVCLT-13