escher 0.0.2 → 0.0.5

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: ee0a2544d5cff2fa6068a42800a3730bb6bc6f2b
+  data.tar.gz: 4b005a107aaf2b1318ba6118f2561b8401c2775b
+SHA512:
+  metadata.gz: 89857d68c47ecf021465f9916e5527201848bea36cafbceff39db30dfb95bc2fbdceba251ab89309e1754f506b85f130dec989064e2b4b3283b17997ffac84e9
+  data.tar.gz: 96ebd6515e11fe2c5ce9d96a4231cf6b58d5f955fa3e36eb8cc62681e332c85dc8a4bbefc5a8e9f2a58696646b2b6f355e4d68142c6520ba09119452af06a32f

data/.gitignore

@@ -0,0 +1,16 @@
+# Ignore bundler config.
+/.bundle
+
+.idea
+*.gem
+Gemfile.lock
+/vendor/
+
+
+# Ignore all logfiles and tempfiles.
+/log/*.log
+/tmp
+
+.env
+.ruby-version
+.rbenv-version

data/.travis.yml

@@ -0,0 +1,4 @@
+language: ruby
+rvm:
+  - 1.9.3
+  - 2.1.2

data/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gemspec

data/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Emarsys Technologies Kft.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,8 @@
+EscherRuby - HTTP request signing lib [![Build Status](https://travis-ci.org/emartech/escher-ruby.svg?branch=master)](https://travis-ci.org/emartech/escher-ruby)
+=====================================
+
+Escher helps you creating secure HTTP requests (for APIs) by signing HTTP(s) requests. It's both a server side and client side implementation. The status is work in progress.
+
+The algorithm is based on [Amazon's _AWS Signature Version 4_](http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html), but we have generalized and extended it.
+
+More details will be available at our [documentation site](https://documentation.emarsys.com/).

data/Rakefile

@@ -0,0 +1,11 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+desc "Run RSpec code examples (options: RSPEC_SEED=seed)"
+RSpec::Core::RakeTask.new :spec do |task|
+  task.verbose = false
+  task.rspec_opts = "--format progress --order random"
+  task.rspec_opts << " --seed #{ENV['RSPEC_SEED']}" if ENV['RSPEC_SEED']
+end
+
+task :default => :spec

data/escher.gemspec

@@ -0,0 +1,26 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'escher/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "escher"
+  spec.version       = Escher::VERSION
+  spec.authors       = ["Andras Barthazi"]
+  spec.email         = ["andras.barthazi@emarsys.com"]
+  spec.summary       = %q{Escher - Emarsys request signing library}
+  spec.description   = %q{For Emarsys API}
+  spec.homepage      = "http://emarsys.com"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0")
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler", "~> 1.6"
+  spec.add_development_dependency "rake", "~> 10"
+  spec.add_development_dependency "rspec", "~> 2"
+
+  spec.add_runtime_dependency "addressable", "~> 2.3"
+end

data/lib/escher/version.rb

@@ -0,0 +1,3 @@
+class Escher
+  VERSION = "0.0.5"
+end

data/lib/escher.rb

@@ -1,181 +1,325 @@
+require 'escher/version'
+
 require 'time'
-require 'uri'
 require 'digest'
+require 'pathname'
+require 'addressable/uri'
 
 class EscherError < RuntimeError
 end
 
-module Escher
-  VERSION = '0.0.2'
+class Escher
+
+  def initialize(credential_scope, options)
+    @credential_scope = credential_scope
+    @algo_prefix      = options[:algo_prefix]      || 'ESR'
+    @vendor_key       = options[:vendor_key]       || 'Escher'
+    @hash_algo        = options[:hash_algo]        || 'SHA256'
+    @current_time     = options[:current_time]     || Time.now
+    @auth_header_name = options[:auth_header_name] || 'X-Escher-Auth'
+    @date_header_name = options[:date_header_name] || 'X-Escher-Date'
+    @clock_skew       = options[:clock_skew]       || 900
+  end
 
-  def self.default_options
-    {:auth_header_name => 'X-Ems-Auth', :date_header_name => 'X-Ems-Date', :vendor_prefix => 'EMS'}
+  def sign!(request, client)
+    uri_parsed = URI.parse(request.path)
+    request['Host'] = uri_parsed.host # TODO: we shouldn't remove port from Host here
+    request[@date_header_name] = format_date_for_header
+    request[@auth_header_name] = generate_auth_header(client, request.method, uri_parsed.host, uri_parsed.path, request.body || '', request.to_enum.to_a, [])
+    request
   end
 
-  def self.validate_request(method, request_uri, body, headers, key_db, accepted_credentials, current_time = Time.now, options = {})
+  def validate(request, key_db)
+    headers = []
+    request.header.each { |key, values|
+      values.each { |value|
+        headers += [[ key, value ]]
+      }
+    }
+    validate_request(key_db, request.request_method, request.path, request.body, headers)
+  end
 
-    options = default_options.merge(options)
-    host = get_header('host', headers)
-    date = get_header(options[:date_header_name], headers)
-    auth_header = get_header(options[:auth_header_name], headers)
+  def is_valid?(*args)
+    begin
+      validate(*args)
+      return true
+    rescue
+      return false
+    end
+  end
 
-    algo, api_key_id, short_date, credential_scope, signed_headers, signature = parse_auth_header auth_header, options[:vendor_prefix]
+  def validate_request(key_db, method, request_uri, body, headers)
+    path, query_parts = parse_uri(request_uri)
+    signature_from_query = get_signing_param('Signature', query_parts)
 
-    raise EscherError, 'Host header is not signed' unless signed_headers.include? 'host'
-    raise EscherError, 'Date header is not signed' unless signed_headers.include? options[:date_header_name].downcase
-    raise EscherError, 'Invalid request date' unless short_date(date) == short_date && within_range(current_time, date)
-    # TODO validate host header
-    raise EscherError, 'Invalid credentials' unless credential_scope == accepted_credentials
+    validate_headers(headers, signature_from_query)
 
+    if method == 'GET' && signature_from_query
+      raw_date = get_signing_param('Date', query_parts)
+      algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires = get_auth_parts_from_query(query_parts)
+
+      body = 'UNSIGNED-PAYLOAD'
+      query_parts.delete [query_key_for('Signature'), signature]
+      query_parts = query_parts.map { |k, v| [uri_decode(k), uri_decode(v)] }
+    else
+      raw_date = get_header(@date_header_name, headers)
+      auth_header = get_header(@auth_header_name, headers)
+      algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires = get_auth_parts_from_header(auth_header)
+    end
+
+    date = Time.parse(raw_date)
     api_secret = key_db[api_key_id]
 
-    signature == generate_signature(algo, api_secret, body, credential_scope.join('/'), date, headers, method, signed_headers, host, request_uri, options[:vendor_prefix], options[:auth_header_name], options[:date_header_name])
+    raise EscherError, 'Invalid API key' unless api_secret
+    raise EscherError, 'Only SHA256 and SHA512 hash algorithms are allowed' unless %w(SHA256 SHA512).include?(algorithm)
+    raise EscherError, 'Invalid request date' unless short_date(date) == short_date
+    raise EscherError, 'The request date is not within the accepted time range' unless is_date_within_range?(date, expires)
+    raise EscherError, 'Invalid credentials' unless credential_scope == @credential_scope
+    raise EscherError, 'Host header is not signed' unless signed_headers.include? 'host'
+    raise EscherError, 'Only the host header should be signed' if signature_from_query && signed_headers != ['host']
+    raise EscherError, 'Date header is not signed' if !signature_from_query && !signed_headers.include?(@date_header_name.downcase)
+
+    escher = reconfig(algorithm, credential_scope, date)
+    expected_signature = escher.generate_signature(api_secret, body, headers, method, signed_headers, path, query_parts)
+    raise EscherError, 'The signatures do not match' unless signature == expected_signature
+  end
+
+  def validate_headers(headers, using_query_string_for_validation)
+    (['Host'] + (using_query_string_for_validation ? [] : [@auth_header_name, @date_header_name])).each do |header|
+      raise EscherError, 'Missing header: ' + header unless get_header(header, headers)
+    end
+  end
+
+  def reconfig(algorithm, credential_scope, date)
+    Escher.new(
+        credential_scope,
+        algo_prefix: @algo_prefix,
+        vendor_key: @vendor_key,
+        hash_algo: algorithm,
+        auth_header_name: @auth_header_name,
+        date_header_name: @date_header_name,
+        current_time: date
+    )
+  end
+
+  def generate_auth_header(client, method, host, request_uri, body, headers, headers_to_sign)
+    path, query_parts = parse_uri(request_uri)
+    headers = add_defaults_to(headers, host)
+    headers_to_sign |= [@date_header_name.downcase, 'host']
+    signature = generate_signature(client[:api_secret], body, headers, method, headers_to_sign, path, query_parts)
+    "#{get_algorithm_id} Credential=#{client[:api_key_id]}/#{short_date(@current_time)}/#{@credential_scope}, SignedHeaders=#{prepare_headers_to_sign headers_to_sign}, Signature=#{signature}"
+  end
+
+  def generate_signed_url(url_to_sign, client, expires = 86400)
+    uri = Addressable::URI.parse(url_to_sign)
+    protocol = uri.scheme
+    host = uri.host
+    path = uri.path
+    query_parts = parse_query(uri.query)
+
+    headers = [['host', host]]
+    headers_to_sign = ['host']
+    body = 'UNSIGNED-PAYLOAD'
+    query_parts += get_signing_params(client, expires, headers_to_sign)
+
+    signature = generate_signature(client[:api_secret], body, headers, 'GET', headers_to_sign, path, query_parts)
+    query_parts_with_signature = (query_parts.map { |k, v| [uri_encode(k), uri_encode(v)] } << query_pair('Signature', signature))
+
+    protocol + '://' + host + path + '?' + query_parts_with_signature.map { |k, v| k + '=' + v }.join('&')
+  end
+
+  def get_signing_params(client, expires, headers_to_sign)
+    [
+        ['Algorithm', get_algorithm_id],
+        ['Credentials', "#{client[:api_key_id]}/#{short_date(@current_time)}/#{@credential_scope}"],
+        ['Date', long_date(@current_time)],
+        ['Expires', expires.to_s],
+        ['SignedHeaders', headers_to_sign.join(';')],
+    ].map { |k, v| query_pair(k, v) }
+  end
+
+  def query_pair(k, v)
+    [query_key_for(k), v]
+  end
+
+  def query_key_for(key)
+    "X-#{@vendor_key}-#{key}"
   end
 
-  def self.short_date(date)
-    long_date(date)[0..7]
+  def query_key_truncate(key)
+    key[@vendor_key.length + 3..-1]
   end
 
-  def self.within_range(current_time, date)
-    (current_time - 900 .. current_time + 900).cover?(Time.parse date)
+  def get_header(header_name, headers)
+    the_header = (headers.detect { |header| header[0].downcase == header_name.downcase })
+    the_header ? the_header[1] : nil
   end
 
-  def self.get_header(header_name, headers)
-    header = (headers.detect { |header| header[0].downcase == header_name.downcase })
-    raise EscherError, "Missing header: #{header_name.downcase}" unless header
-    header[1]
+  def get_signing_param(key, query_parts)
+    the_param = (query_parts.detect { |param| param[0] === query_key_for(key) })
+    the_param ? uri_decode(the_param[1]) : nil
   end
 
-  def self.parse_auth_header(auth_header, vendor_prefix)
-    m = /#{vendor_prefix.upcase}-HMAC-(?<algo>[A-Z0-9\,]+) Credential=(?<api_key_id>[A-Za-z0-9\-_]+)\/(?<short_date>[0-9]{8})\/(?<credentials>[A-Za-z0-9\-_\/]+), SignedHeaders=(?<signed_headers>[A-Za-z\-;]+), Signature=(?<signature>[0-9a-f]+)$/
+  def get_auth_parts_from_header(auth_header)
+    m = /#{@algo_prefix}-HMAC-(?<algo>[A-Z0-9\,]+) Credential=(?<api_key_id>[A-Za-z0-9\-_]+)\/(?<short_date>[0-9]{8})\/(?<credentials>[A-Za-z0-9\-_\/]+), SignedHeaders=(?<signed_headers>[A-Za-z\-;]+), Signature=(?<signature>[0-9a-f]+)$/
     .match auth_header
     raise EscherError, 'Malformed authorization header' unless m && m['credentials']
-    [
-        m['algo'],
-        m['api_key_id'],
-        m['short_date'],
-        m['credentials'].split('/'),
-        m['signed_headers'].split(';'),
-        m['signature'],
-    ]
+    return m['algo'], m['api_key_id'], m['short_date'], m['credentials'], m['signed_headers'].split(';'), m['signature'], 0
+  end
+
+  def get_auth_parts_from_query(query_parts)
+    expires = get_signing_param('Expires', query_parts).to_i
+    api_key_id, short_date, credential_scope = get_signing_param('Credentials', query_parts).split('/', 3)
+    signed_headers = get_signing_param('SignedHeaders', query_parts).split ';'
+    algorithm = parse_algo(get_signing_param('Algorithm', query_parts))
+    signature = get_signing_param('Signature', query_parts)
+    return algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires
+  end
+
+  def generate_signature(api_secret, body, headers, method, signed_headers, path, query_parts)
+    canonicalized_request = canonicalize(method, path, query_parts, body, headers, signed_headers.uniq)
+    string_to_sign = get_string_to_sign(canonicalized_request)
+    signing_key = calculate_signing_key(api_secret)
+    Digest::HMAC.hexdigest(string_to_sign, signing_key, create_algo)
+  end
+
+  def add_defaults_to(headers, host)
+    [['host', host], [@date_header_name, format_date_for_header]]
+      .each { |k, v| headers = add_if_missing headers, k, v }
+    headers
   end
 
-  def self.generate_auth_header(client, method, host, request_uri, body, headers, headers_to_sign, date = Time.now.utc.rfc2822, algo = 'SHA256', options = {})
-    options = default_options.merge options
-    signature = generate_signature(algo, client[:api_secret], body, credential_scope_as_string(client), date, headers, method, headers_to_sign, host, request_uri, options[:vendor_prefix], options[:auth_header_name], options[:date_header_name])
-    "#{algo_id(options[:vendor_prefix], algo)} Credential=#{client[:api_key_id]}/#{short_date(date)}/#{credential_scope_as_string(client)}, SignedHeaders=#{headers_to_sign.uniq.join ';'}, Signature=#{signature}"
+  def format_date_for_header
+    @date_header_name.downcase == 'date' ? @current_time.utc.rfc2822.sub('-0000', 'GMT') : long_date(@current_time)
   end
 
-  def self.credential_scope_as_string(client)
-    client[:credential_scope].join '/'
+  def add_if_missing(headers, header_to_find, value)
+    headers += [header_to_find, value] unless headers.find { |header| header[0].downcase == header_to_find.downcase }
+    headers
   end
 
-  def self.generate_signature(algo, api_secret, body, credential_scope, date, headers, method, signed_headers, host, request_uri, vendor_prefix, auth_header_name, date_header_name)
-    canonicalized_request = canonicalize method, host, request_uri, body, date, headers, signed_headers, algo, auth_header_name, date_header_name
-    string_to_sign = get_string_to_sign credential_scope, canonicalized_request, date, vendor_prefix, algo
-    signing_key = calculate_signing_key api_secret, date, vendor_prefix, credential_scope, algo
-    calculate_signature algo, signing_key, string_to_sign
+  def canonicalize(method, path, query_parts, body, headers, headers_to_sign)    [
+      method,
+      canonicalize_path(path),
+      canonicalize_query(query_parts),
+      canonicalize_headers(headers, headers_to_sign).join("\n"),
+      '',
+      prepare_headers_to_sign(headers_to_sign),
+      create_algo.new.hexdigest(body || '') # TODO: we should set the default value at the same level at every implementation
+    ].join "\n"
   end
 
-  def self.calculate_signature(algo, signing_key, string_to_sign)
-    Digest::HMAC.hexdigest(string_to_sign, signing_key, create_algo(algo))
+  def prepare_headers_to_sign(headers_to_sign)
+    headers_to_sign.sort.uniq.join(';')
   end
 
-  def self.canonicalize(method, host, request_uri, body, date, headers, headers_to_sign, algo, auth_header_name, date_header_name)
+  def parse_uri(request_uri)
     path, query = request_uri.split '?', 2
+    return path, parse_query(query)
+  end
+
+  def parse_query(query)
+    (query || '')
+    .split('&', -1)
+    .map { |pair| pair.split('=', -1) }
+    .map { |k, v| (k.include?' ') ? [k.str(/\S+/), ''] : [k, v] }
+  end
+
+  def get_string_to_sign(canonicalized_req)
+    [
+      get_algorithm_id,
+      long_date(@current_time),
+      short_date(@current_time) + '/' + @credential_scope,
+      create_algo.new.hexdigest(canonicalized_req)
+    ].join("\n")
+  end
 
-    ([
-        method.upcase,
-        canonicalize_path(path),
-        canonicalize_query(query),
-    ] + canonicalize_headers(date, host, headers, auth_header_name, date_header_name) + [
-        '',
-        (headers_to_sign | [date_header_name.downcase, 'host']).join(';'),
-        request_body_hash(body, algo)
-    ]).join "\n"
-  end
-
-  # TODO: extract algo creation
-  def self.get_string_to_sign(credential_scope, canonicalized_request, date, prefix, algo)
-    date = long_date(date)
-    lines = [
-        algo_id(prefix, algo),
-        date,
-        date[0..7] + '/' + credential_scope,
-        create_algo(algo).new.hexdigest(canonicalized_request)
-    ]
-    lines.join "\n"
-  end
-
-  def self.create_algo(algo)
-    case algo.upcase
+  def create_algo
+    case @hash_algo
       when 'SHA256'
-        return Digest::SHA256
+        return Digest::SHA2.new 256
       when 'SHA512'
-        return Digest::SHA512
+        return Digest::SHA2.new 512
       else
         raise EscherError, 'Unidentified hash algorithm'
     end
   end
 
-  def self.long_date(date)
-    Time.parse(date).utc.strftime("%Y%m%dT%H%M%SZ")
+  def long_date(date)
+    date.utc.strftime('%Y%m%dT%H%M%SZ')
   end
 
-  def self.algo_id(prefix, algo)
-    prefix + '-HMAC-' + algo
+  def short_date(date)
+    date.utc.strftime('%Y%m%d')
   end
 
-  def self.calculate_signing_key(api_secret, date, vendor_prefix, credential_scope, algo)
-    signing_key = vendor_prefix + api_secret
-    for data in [short_date(date)] + credential_scope.split('/') do
-      signing_key = Digest::HMAC.digest(data, signing_key, create_algo(algo))
-    end
+  def is_date_within_range?(request_date, expires)
+    (request_date - @clock_skew .. request_date + expires + @clock_skew).cover? @current_time
+  end
+
+  def get_algorithm_id
+    @algo_prefix + '-HMAC-' + @hash_algo
+  end
+
+  def parse_algo(algorithm)
+    m = /^#{@algo_prefix}-HMAC-(?<algo>[A-Z0-9\,]+)$/.match(algorithm)
+    m && m['algo']
+  end
+
+  def calculate_signing_key(api_secret)
+    algo = create_algo
+    signing_key = @algo_prefix + api_secret
+    key_parts = [short_date(@current_time)] + @credential_scope.split('/')
+    key_parts.each { |data|
+      signing_key = Digest::HMAC.digest(data, signing_key, algo)
+    }
     signing_key
   end
 
-  def self.canonicalize_path(path)
+  def canonicalize_path(path)
     while path.gsub!(%r{([^/]+)/\.\./?}) { |match| $1 == '..' ? match : '' } do end
     path.gsub(%r{/\./}, '/').sub(%r{/\.\z}, '/').gsub(/\/+/, '/')
   end
 
-  def self.canonicalize_headers(date, host, raw_headers, auth_header_name, date_header_name)
-    collect_headers(raw_headers, auth_header_name).merge({date_header_name.downcase => [date], 'host' => [host]})
+  def canonicalize_headers(raw_headers, headers_to_sign)
+    collect_headers(raw_headers)
       .sort
-      .map { |k, v| k + ':' + (v.sort_by { |x| x }).join(',').gsub(/\s+/, ' ').strip }
+      .select { |k, v| headers_to_sign.include?(k) }
+      .map { |k, v| k + ':' + v.map { |piece| normalize_white_spaces piece} .join(',') }
   end
 
-  def self.collect_headers(raw_headers, auth_header_name)
+  def normalize_white_spaces(value)
+    value.strip.split('"', -1).map.with_index { |piece, index|
+      is_inside_of_quotes = (index % 2 === 1)
+      is_inside_of_quotes ? piece : piece.gsub(/\s+/, ' ')
+    }.join '"'
+  end
+
+  def collect_headers(raw_headers)
     headers = {}
-    raw_headers.each { |raw_header|
-      if raw_header[0].downcase != auth_header_name.downcase then
-        if headers[raw_header[0].downcase] then
+    raw_headers.each do |raw_header|
+      if raw_header[0].downcase != @auth_header_name.downcase
+        if headers[raw_header[0].downcase]
           headers[raw_header[0].downcase] << raw_header[1]
         else
           headers[raw_header[0].downcase] = [raw_header[1]]
         end
       end
-    }
+    end
     headers
   end
 
-  def self.request_body_hash(body, algo)
-    create_algo(algo).new.hexdigest body
+  def canonicalize_query(query_parts)
+    query_parts
+      .map { |k, v| uri_encode(k.gsub('+', ' ')) + '=' + uri_encode(v || '') }
+      .sort.join '&'
   end
 
-  def self.canonicalize_query(query)
-    query = query || ''
-    query.split('&', -1)
-    .map { |pair| k, v = pair.split('=', -1)
-    if k.include? ' ' then
-      [k.str(/\S+/), '']
-    else
-      [k, v]
-    end }
-    .map { |pair|
-      k, v = pair;
-      URI::encode(k.gsub('+', ' ')) + '=' + URI::encode(v || '')
-    }
-    .sort.join '&'
+  def uri_encode(component)
+    Addressable::URI.encode_component(component, Addressable::URI::CharacterClasses::UNRESERVED)
+  end
+
+  def uri_decode(component)
+    Addressable::URI.unencode_component(component)
   end
 end

data/spec/aws4_testsuite/get-header-key-duplicate.authz

@@ -0,0 +1 @@
+AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=54afcaaf45b331f81cd2edb974f7b824ff4dd594cbbaa945ed636b48477368ed

data/spec/aws4_testsuite/get-header-key-duplicate.creq

@@ -0,0 +1,9 @@
+POST
+/
+
+date:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+zoo:foobar,zoobar,zoobar
+
+date;host;zoo
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

data/spec/aws4_testsuite/get-header-key-duplicate.req

@@ -0,0 +1,7 @@
+POST / http/1.1
+DATE:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+ZOO:zoobar
+zoo:foobar
+zoo:zoobar
+

data/spec/aws4_testsuite/get-header-key-duplicate.sreq

@@ -0,0 +1,8 @@
+POST / http/1.1
+DATE:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+ZOO:zoobar
+zoo:foobar
+zoo:zoobar
+Authorization: AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=54afcaaf45b331f81cd2edb974f7b824ff4dd594cbbaa945ed636b48477368ed
+

data/spec/aws4_testsuite/get-header-key-duplicate.sts

@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20110909T233600Z
+20110909/us-east-1/host/aws4_request
+3c52f0eaae2b61329c0a332e3fa15842a37bc5812cf4d80eb64784308850e313

data/spec/aws4_testsuite/get-header-value-multiline.req

@@ -0,0 +1,7 @@
+POST / http/1.1
+DATE:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+p:a
+  b
+	c
+

data/spec/aws4_testsuite/get-header-value-order.authz

@@ -0,0 +1 @@
+AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=d2973954263943b11624a11d1c963ca81fb274169c7868b2858c04f083199e3d

data/spec/aws4_testsuite/get-header-value-order.creq

@@ -0,0 +1,9 @@
+POST
+/
+
+date:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+p:a,a,p,z
+
+date;host;p
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

data/spec/aws4_testsuite/get-header-value-order.req

@@ -0,0 +1,8 @@
+POST / http/1.1
+DATE:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+p:z
+p:a
+p:p
+p:a
+

data/spec/aws4_testsuite/get-header-value-order.sreq

@@ -0,0 +1,9 @@
+POST / http/1.1
+DATE:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+p:z
+p:a
+p:p
+p:a
+Authorization: AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=d2973954263943b11624a11d1c963ca81fb274169c7868b2858c04f083199e3d
+

data/spec/aws4_testsuite/get-header-value-order.sts

@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20110909T233600Z
+20110909/us-east-1/host/aws4_request
+94c0389fefe0988cbbedc8606f0ca0b485b48da010d09fc844b45b697c8924fe

data/spec/aws4_testsuite/get-header-value-trim.authz

@@ -0,0 +1 @@
+AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=debf546796015d6f6ded8626f5ce98597c33b47b9164cf6b17b4642036fcb592

data/spec/aws4_testsuite/get-header-value-trim.creq

@@ -0,0 +1,9 @@
+POST
+/
+
+date:Mon, 09 Sep 2011 23:36:00 GMT
+host:host.foo.com
+p:phfft
+
+date;host;p
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855