feat(sts): accept AssumeRoleWithWebIdentity params from form-encoded POST bodies#112
Draft
alukach wants to merge 1 commit into
Draft
feat(sts): accept AssumeRoleWithWebIdentity params from form-encoded POST bodies#112alukach wants to merge 1 commit into
alukach wants to merge 1 commit into
Conversation
…POST bodies AWS STS accepts parameters in the query string or an application/x-www-form-urlencoded POST body; SDKs send the latter, so the query-only parse made /.sts unreachable from unmodified AWS SDK STS clients and the SDKs' built-in web-identity credential providers. - core: RequestInfo gains an optional form_body field runtimes populate for form-encoded POSTs, plus an is_form_urlencoded_post() predicate so every runtime shares one definition of when to collect it. Form POSTs are not part of the S3 protocol, so collecting them never steals a payload the data path needs. - sts: try_handle_sts checks the query first, then form_body; params are read from exactly one source, never merged (matching AWS). - cf-workers: RequestParts::absorb_form_body() collects such bodies before dispatch and hands back an empty JsBody. - examples: all three runtimes (cf-workers, server, lambda) wire the form body up before building RequestInfo. Refs source-cooperative/data.source.coop#184
|
📖 Docs preview deployed to https://multistore-docs-pr-112.development-seed.workers.dev
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What I'm changing
AWS STS accepts
AssumeRoleWithWebIdentityparameters in the query string or as anapplication/x-www-form-urlencodedPOSTbody — and AWS SDKs exclusively send the latter. The STS handler parses the query string only, so an unmodified SDK STS client pointed at the proxy (viaAWS_ENDPOINT_URL_STS), the SDKs' built-in web-identity credential providers (AWS_WEB_IDENTITY_TOKEN_FILE/AWS_ROLE_ARN), andaws-actions/configure-aws-credentialsall fall through the router unhandled. This closes that gap so the STS endpoint is a drop-inAssumeRoleWithWebIdentitytarget for standard AWS tooling, with zero custom exchange code on the client.Downstream motivation: source-cooperative/data.source.coop#184 (its
/.stsis this handler).How I did it
multistore::route_handler—RequestInfogains an optionalform_bodyfield plus awith_form_bodybuilder, and anis_form_urlencoded_post()predicate so every runtime shares one definition of when to collect a body. Form-encodedPOSTs are not part of the S3 protocol, so collecting them never steals a payload the forwarding path needs.Router::dispatchthreads the field through itsRequestInforeconstruction.multistore-sts—try_handle_ststakesform_bodyalongsidequeryand triestry_parse_sts_requeston the query first, then the body. Parameters are read from exactly one source, never merged across the two (matching AWS). The parser itself is untouched — it already parses a form-urlencoded string.multistore-cf-workers—RequestPartsgainsform_bodyand anabsorb_form_body(JsBody) -> Result<JsBody>helper: a no-op passthrough for every other request shape, so integrators call it unconditionally betweenfrom_web_sysand dispatch.as_request_info()wires the field through./.sts, so all three now collect form bodies before buildingRequestInfo(the axum server bounds collection at 64 KiB; lambda bodies are already buffered).auth/proxy-auth.mdandreference/operations.mdnow state both parameter sources and the SDK-compatibility rationale.Test plan
cargo test— new route-handler tests: a form-bodyPOSTwith no query string is intercepted; a non-STS form body falls through; newis_form_urlencoded_posttests cover charset/casing, wrong method, wrong content type (S3 batch deletePOST+ XML), and no content type.cargo check --all-targetscargo check -p multistore-cf-workers --target wasm32-unknown-unknowncargo fmt/cargo clippy --fix(pre-commit hook)🤖 Generated with Claude Code
https://claude.ai/code/session_01Hk6VMBuKNcTK3boS8HrdQs