alexferl / zerohttp / 22927420302

94%

Build Type

push

github

Committed by web-flow

Commit Message

  fix: prevent HMAC auth middleware from modifying request headers (#70)

The parsePresignedURLParams() function was setting the X-Timestamp
  header as a side effect to pass required header checks. This modified
  the original request which could affect downstream handlers.

  Changes:
  - Removed r.Header.Set() from parsePresignedURLParams()
  - Modified buildSignedHeaders() to accept timestamp from parsedAuth
  - Skip required header check for presigned URLs (timestamp from URL)
  - Add test to verify headers are not modified

Signed-off-by: alexferl <me@alexferl.com>

Coverage Stats

14 of 25 new or added lines in 1 file covered. (56.0%)

5 existing lines in 1 file now uncovered.

8095 of 8662 relevant lines covered (93.45%)

49.06 hits per line