Support async V4 payload signing by dagnir · Pull Request #6314 · aws/aws-sdk-java-v2

dagnir · 2025-08-01T18:18:40Z

Motivation and Context

This commit adds support for SigV4 signing of async request payloads.

In addition this commit moves the support for trailing checksums from HttpChecksumStage to the V4 signer implementation; this puts it in line with how sync chunked bodies are already handled.

This fills a gap in our signing logic where payloads that would normally be signed are not.

Modifications

Remove trailing checksum path for SRA signed requests in HttpChecksumStage; trailing checksums taken care of in AwsChunkedV4PayloadSigner, same as for sync payloads
Support payload signing and trailers for async requests in AwsChunkedV4PayloadSigner
Internal refactor of AwschunkedV4PayloadSigner to reduce code duplication

Testing

New unit tests
Enable previously disabled tests that were not passing
Ran integ tests

Screenshots (if appropriate)

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)

Checklist

I have read the CONTRIBUTING document
Local run of mvn install succeeds
My code follows the code style of this project
My change requires a change to the Javadoc documentation
I have updated the Javadoc documentation accordingly
I have added tests to cover my changes
All new and existing tests passed
I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

I confirm that this pull request can be released under the Apache 2 license

dagnir · 2025-08-05T21:02:46Z

...test/java/software/amazon/awssdk/services/AsyncRequestBodyFlexibleChecksumInTrailerTest.java

-                "4000" + CRLF + contentString.substring(0, 16 * KB) + CRLF
-                + "4000" + CRLF + contentString.substring(16 * KB, 32 * KB) + CRLF
-                + "1400" + CRLF + contentString.substring(32 * KB) + CRLF


FYI this is because we use the default chunk size in DefaultAwsV4HttpSigner now, which is 128 KiB, so the 37KiB payload fits in a single chunk:

aws-sdk-java-v2/core/http-auth-aws/src/main/java/software/amazon/awssdk/http/auth/aws/internal/signer/DefaultAwsV4HttpSigner.java

Line 53 in 43f262c

private static final int DEFAULT_CHUNK_SIZE_IN_BYTES = 128 * 1024;

dagnir · 2025-08-05T21:03:24Z

services/s3/src/test/java/software/amazon/awssdk/services/s3/functionaltests/S3ExpressTest.java

-        if (protocol == Protocol.HTTP && clientType == ClientType.SYNC) {
+    void verifyPutObjectHeaders(Protocol protocol, ChecksumAlgorithm checksumAlgorithm) {
+        String streamingSha256;
+        if (protocol == Protocol.HTTP) {


Fallback to body content signing now works for async requests

This commit adds support for SigV4 signing of async request payloads. In addition this commit moves the support for trailing checksums from HttpChecksumStage to the V4 signer implementation; this puts it in line with how sync chunked bodies are already handled.

alextwoods

Is there a performance regression risk for customers that have been using http to avoid tls overhead?

...c/main/java/software/amazon/awssdk/http/auth/aws/internal/signer/DefaultAwsV4HttpSigner.java

...tware/amazon/awssdk/http/auth/aws/internal/signer/chunkedencoding/ChunkedEncodedPayload.java

...ain/java/software/amazon/awssdk/http/auth/aws/internal/signer/AwsChunkedV4PayloadSigner.java

...va/software/amazon/awssdk/http/auth/aws/internal/signer/io/UnbufferedChecksumSubscriber.java

...aws/src/main/java/software/amazon/awssdk/http/auth/aws/internal/signer/util/SignerUtils.java

dagnir · 2025-08-06T17:40:35Z

Is there a performance regression risk for customers that have been using http to avoid tls overhead?

Yes, this is probably true, but this is a functionality gap rather than a feature, so I think this is okay. I don't have concrete numbers, but I will start some long running tests to see.

...tware/amazon/awssdk/http/auth/aws/internal/signer/chunkedencoding/ChunkedEncodedPayload.java

- Rename to computeAndMoveContentLength - Rename variable to chunkedPayload - Fix javadocs - Sign payload only if non-null

alextwoods · 2025-09-04T16:20:24Z

...c/main/java/software/amazon/awssdk/core/internal/http/pipeline/stages/HttpChecksumStage.java


-        SdkHttpRequest httpRequest = context.executionContext().interceptorContext().httpRequest();
-
-        // TODO(sra-identity-and-auth): payload checksum calculation (trailer) for sync is done in AwsChunkedV4PayloadSigner,


Note: The removal of this check fixes #6387

dagnir · 2025-10-10T18:22:23Z

Replaced by #6466.

dagnir force-pushed the dongie/chunked-encoded-sigv4-async branch 2 times, most recently from 4085d5e to 8a30699 Compare August 1, 2025 22:40

dagnir changed the title ~~Dongie/chunked encoded sigv4 async~~ Support async V4 payload signing Aug 1, 2025

dagnir force-pushed the dongie/chunked-encoded-sigv4-async branch 4 times, most recently from f80adb0 to 9fa0bad Compare August 5, 2025 21:01

dagnir commented Aug 5, 2025

View reviewed changes

dagnir force-pushed the dongie/chunked-encoded-sigv4-async branch from 9fa0bad to 395a9cb Compare August 5, 2025 21:04

dagnir force-pushed the dongie/chunked-encoded-sigv4-async branch from 395a9cb to 7c7941c Compare August 5, 2025 21:14

dagnir marked this pull request as ready for review August 5, 2025 21:14

dagnir requested a review from a team as a code owner August 5, 2025 21:14

alextwoods reviewed Aug 6, 2025

View reviewed changes

...tware/amazon/awssdk/http/auth/aws/internal/signer/chunkedencoding/ChunkedEncodedPayload.java Outdated Show resolved Hide resolved

Review comments

a222719

- Rename to computeAndMoveContentLength - Rename variable to chunkedPayload - Fix javadocs - Sign payload only if non-null

dagnir force-pushed the dongie/chunked-encoded-sigv4-async branch from 0a7ec87 to a222719 Compare August 6, 2025 23:56

alextwoods mentioned this pull request Sep 4, 2025

S3AsyncClient doesn't respect chunkedEncodingEnabled(false) #6387

Closed

1 task

alextwoods reviewed Sep 4, 2025

View reviewed changes

dagnir closed this Oct 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support async V4 payload signing#6314

Support async V4 payload signing#6314
dagnir wants to merge 2 commits intomasterfrom
dongie/chunked-encoded-sigv4-async

dagnir commented Aug 1, 2025 •

edited

Loading

Uh oh!

dagnir Aug 5, 2025 •

edited

Loading

Uh oh!

dagnir Aug 5, 2025

Uh oh!

alextwoods left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dagnir commented Aug 6, 2025

Uh oh!

Uh oh!

alextwoods Sep 4, 2025

Uh oh!

dagnir commented Oct 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		SdkHttpRequest httpRequest = context.executionContext().interceptorContext().httpRequest();

		// TODO(sra-identity-and-auth): payload checksum calculation (trailer) for sync is done in AwsChunkedV4PayloadSigner,

Conversation

dagnir commented Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

Modifications

Testing

Screenshots (if appropriate)

Types of changes

Checklist

License

Uh oh!

dagnir Aug 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dagnir Aug 5, 2025

Choose a reason for hiding this comment

Uh oh!

alextwoods left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dagnir commented Aug 6, 2025

Uh oh!

Uh oh!

alextwoods Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

dagnir commented Oct 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dagnir commented Aug 1, 2025 •

edited

Loading

dagnir Aug 5, 2025 •

edited

Loading