starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #5064] [bug]: AWS Signature v4 auth signing does not include request body #1928

New issue

Closed

opened 2026-03-16 22:24:59 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 22:24:59 +03:00

Owner

Originally created by @stephenlagree on GitHub (May 9, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5064

Originally assigned to: @anwarulislam on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Current behavior

When I use aws sigv4 auth to send a request that isn't GET, such as PATCH, I get the following error:

{
  "message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'PATCH\n/REDACTED\n\nREDACTED\nx-amz-date:20250509T163523Z\n\nhost;x-amz-date\nc128285c6e93ba2b596a26e161aa5f5089ee39bbe2b668259c250a252d12f435'\n\nThe String-to-Sign should have been\n'AWS4-HMAC-SHA256\n20250509T163523Z\n20250509/us-west-2/execute-api/aws4_request\nacda060976169acf8584c162ffab97c61876d1cf55df6168299296a4f87bbea1'\n"
}

GET works fine. I looked at the code and saw that the body is not included in the request signing. I believe this requires a fix in packages/hoppscotch-cli/src/utils/pre-request.ts:

      const signer = new AwsV4Signer({
        method,
        datetime: amzDate,
        signQuery: addTo === "QUERY_PARAMS",
        accessKeyId: parseTemplateString(
          request.auth.accessKey,
          resolvedVariables
        ),
        secretAccessKey: parseTemplateString(
          request.auth.secretKey,
          resolvedVariables
        ),
        region:
          parseTemplateString(request.auth.region, resolvedVariables) ??
          "us-east-1",
        service: parseTemplateString(
          request.auth.serviceName,
          resolvedVariables
        ),
        url: parseTemplateString(endpoint, resolvedVariables),
        sessionToken:
          request.auth.serviceToken &&
          parseTemplateString(request.auth.serviceToken, resolvedVariables),
      });

It should also include something like this:

        body: request.body.body?.toString() ?? undefined,

Steps to reproduce

Use AWS Signature authorization
Attempt to make a PATCH request to a valid endpoint

Logs and Screenshots

{
  "message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'PATCH\n/REDACTED\n\nREDACTED\nx-amz-date:20250509T163523Z\n\nhost;x-amz-date\nc128285c6e93ba2b596a26e161aa5f5089ee39bbe2b668259c250a252d12f435'\n\nThe String-to-Sign should have been\n'AWS4-HMAC-SHA256\n20250509T163523Z\n20250509/us-west-2/execute-api/aws4_request\nacda060976169acf8584c162ffab97c61876d1cf55df6168299296a4f87bbea1'\n"
}

Environment

Production

Hoppscotch Version

Cloud

Interceptor

Not Applicable - Issue not related to network requests

Browsers Affected

No response

Operating System

MacOS

Additional Information

No response

Originally created by @stephenlagree on GitHub (May 9, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5064 Originally assigned to: @anwarulislam on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Current behavior When I use aws sigv4 auth to send a request that isn't GET, such as PATCH, I get the following error: ``` { "message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'PATCH\n/REDACTED\n\nREDACTED\nx-amz-date:20250509T163523Z\n\nhost;x-amz-date\nc128285c6e93ba2b596a26e161aa5f5089ee39bbe2b668259c250a252d12f435'\n\nThe String-to-Sign should have been\n'AWS4-HMAC-SHA256\n20250509T163523Z\n20250509/us-west-2/execute-api/aws4_request\nacda060976169acf8584c162ffab97c61876d1cf55df6168299296a4f87bbea1'\n" } ``` GET works fine. I looked at the code and saw that the body is not included in the request signing. I believe this requires a fix in ```packages/hoppscotch-cli/src/utils/pre-request.ts```: ``` const signer = new AwsV4Signer({ method, datetime: amzDate, signQuery: addTo === "QUERY_PARAMS", accessKeyId: parseTemplateString( request.auth.accessKey, resolvedVariables ), secretAccessKey: parseTemplateString( request.auth.secretKey, resolvedVariables ), region: parseTemplateString(request.auth.region, resolvedVariables) ?? "us-east-1", service: parseTemplateString( request.auth.serviceName, resolvedVariables ), url: parseTemplateString(endpoint, resolvedVariables), sessionToken: request.auth.serviceToken && parseTemplateString(request.auth.serviceToken, resolvedVariables), }); ``` It should also include something like this: ``` body: request.body.body?.toString() ?? undefined, ``` ### Steps to reproduce 1. Use AWS Signature authorization 2. Attempt to make a PATCH request to a valid endpoint ### Logs and Screenshots ```shell { "message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'PATCH\n/REDACTED\n\nREDACTED\nx-amz-date:20250509T163523Z\n\nhost;x-amz-date\nc128285c6e93ba2b596a26e161aa5f5089ee39bbe2b668259c250a252d12f435'\n\nThe String-to-Sign should have been\n'AWS4-HMAC-SHA256\n20250509T163523Z\n20250509/us-west-2/execute-api/aws4_request\nacda060976169acf8584c162ffab97c61876d1cf55df6168299296a4f87bbea1'\n" } ``` ### Environment Production ### Hoppscotch Version Cloud ### Interceptor Not Applicable - Issue not related to network requests ### Browsers Affected _No response_ ### Operating System MacOS ### Additional Information _No response_

kerem

2026-03-16 22:24:59 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 22:25:15 +03:00

Author

Owner

@jamesgeorge007 commented on GitHub (May 29, 2025):

Hi, closing this issue since this is addressed in the latest release. Please feel free to let us know if you have any feedback.

@jamesgeorge007 commented on GitHub (May 29, 2025): Hi, closing this issue since this is addressed in the latest release. Please feel free to let us know if you have any feedback.

kerem commented

2026-03-16 22:25:20 +03:00

Author

Owner

@ShahidPLT commented on GitHub (Jun 18, 2025):

@jamesgeorge007 , I am seeing the same issue on POST request but work fine on GET request

The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details

Version 25.5.2

@ShahidPLT commented on GitHub (Jun 18, 2025): @jamesgeorge007 , I am seeing the same issue on POST request but work fine on GET request `The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details` Version 25.5.2

kerem referenced this issue

2026-03-17 01:10:18 +03:00

[PR #1930] [MERGED] sync request params with bulk editor. #3566