Correct a typo, also enforce host being a required header #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "typo"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
@ -260,1 +260,4 @@with true <- !has_body || uses_header?("digest", used_headers, header_defs),true <-uses_header?("host", used_headers, header_defs) ||uses_header?(:host, used_headers, header_defs),later signature string generation will only read
"host"and afaict actual headers in a plug are guaranteed to always be binaries anyway, so only the first check should be neededthe pure reason for the double check is this test which passes it as an atom - i wasn't sure if this was fully intentional for backwards compat or similar, so checked both
which should be fine i think?
oh, this seems to just be an artefact from the old API. It used to pass all header parameters, except
request-targetfor thesignfunction as atoms. The current API expects it to be all binaries, so as it is called nowit actually ends up generating a borked signature. Must have forgotten to change the type here for some reasonno, i was thinking of the verification processing. It might technically work, but is breaking the documented API contractalright, I'll swap it over to string-only
@ -377,2 +386,3 @@{"date", "Sun, 11 Mar 2018 12:19:36 GMT"},{"digest", "SHA-256=V7Hl6qDK2m8WzNsjzNYSBISi9VoIXLFlyjF/a5o1SOc="}{"digest", "SHA-256=V7Hl6qDK2m8WzNsjzNYSBISi9VoIXLFlyjF/a5o1SOc="},{"host", "example.com"}nit: this and the previous test already fail before it becomes relevant anyway, but due to adding
hosttoheadersthis header is not just missing the key (or for the test above "too old"), but also plain cryptographically incorrect (the current value did not actually sign thehostheader content)