Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong sns message signature #223

Open
DayS1eeper opened this issue Mar 14, 2020 · 1 comment
Open

Wrong sns message signature #223

DayS1eeper opened this issue Mar 14, 2020 · 1 comment

Comments

@DayS1eeper
Copy link
Contributor

DayS1eeper commented Mar 14, 2020

Expected behaviour (SNS)
In Verifying the Signatures of Amazon SNS Messages https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html is specified that string to sign must contain Subject name-value pair if it is included in the message. It doesn't mean that Subject must be omitted if value of Subject key is empty string. In aws-php-sns-message-validator Subject field is omitted only when message doesn't contain it https://github.com/aws/aws-php-sns-message-validator/blob/ba6810807ac8936317021ccc14cdb1297d525ae1/src/MessageValidator.php#L162 , the same logic is present in Example Code for an Amazon SNS Endpoint Java Servlet https://docs.aws.amazon.com/sns/latest/dg/sns-example-code-endpoint-java-servlet.html

Current behaviour (goaws)
Subject is omitted while creating string to sign if the value is empty string
https://github.com/p4tin/goaws/blob/6ecd9bf473ad2b2a88dba5224957826665710dec/app/gosns/gosns.go#L257

It would be great if it were fixed.

@p4tin
Copy link
Collaborator

p4tin commented Apr 18, 2020

As I am involved in other projects at the moment and you seem to have a grasp of the issue, I'd very much welcome a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants