u

scripts/s3-backup/sigv4.mjs

@@ -22,7 +22,6 @@ function parseAuthHeader(header) {
     accessKey: credential[0],
     date: credential[1],
     region: credential[2],
-    service: credential[3],
     signedHeaders: parts.SignedHeaders.split(';'),
     signature: parts.Signature,
   };
@@ -59,6 +58,7 @@ export function verifyRequest(req, body, { accessKey, secretKey, region = 'us-ea
     return false;
   }
 
+  const regionToUse = parsed.region || region;
   const amzDate = getHeader(req, 'x-amz-date');
   const declaredPayload = getHeader(req, 'x-amz-content-sha256');
   const payloadHash =
@@ -72,16 +72,16 @@ export function verifyRequest(req, body, { accessKey, secretKey, region = 'us-ea
     payloadHash,
   ].join('\n');
 
-  const scope = `${parsed.date}/${region}/s3/aws4_request`;
+  const scope = `${parsed.date}/${regionToUse}/s3/aws4_request`;
   const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, hash(canonical)].join('\n');
   const signingKey = hmac(
-    hmac(
-      hmac(hmac(`AWS4${secretKey}`, parsed.date), region),
-      's3'
-    ),
+    hmac(hmac(hmac(`AWS4${secretKey}`, parsed.date), regionToUse), 's3'),
     'aws4_request'
   );
   const expected = hmac(signingKey, stringToSign, 'hex');
+  if (expected.length !== parsed.signature.length) {
+    return false;
+  }
   return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(parsed.signature, 'hex'));
 }