[GH-ISSUE #2513] About automatic downgrade to sigv2 on failed authentication attempts #1225

New issue

Open

opened 2026-03-04 01:52:23 +03:00 by kerem · 1 comment

kerem commented

2026-03-04 01:52:23 +03:00

Owner

Originally created by @ggtakec on GitHub (Aug 17, 2024).
Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/2513

About downgrade to sigv2 automatically

When s3fs checks authentication at startup, if sigv2/sigv4 is not specified intentionally and authentication fails, it downgrades to sigv2 and retries.
We would like to consider whether or not to continue supporting this function.

If all AWS regions have switched to sigv4, automatic downgrade seems unnecessary.

However, the situation of compatible S3 products other than AWS will also need to be taken into consideration. (I think this can be avoided by forcing the specification of either sigv2 or sigv4.)

Originally created by @ggtakec on GitHub (Aug 17, 2024). Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/2513 ### About downgrade to sigv2 automatically When s3fs checks authentication at startup, if sigv2/sigv4 is not specified intentionally and authentication fails, it downgrades to sigv2 and retries. We would like to consider whether or not to continue supporting this function. If all AWS regions have switched to sigv4, automatic downgrade seems unnecessary. However, the situation of compatible S3 products other than AWS will also need to be taken into consideration. (I think this can be avoided by forcing the specification of either sigv2 or sigv4.)

kerem commented

2026-03-04 01:52:23 +03:00

Author

Owner

@gaul commented on GitHub (Aug 24, 2024):

I also dislike the existing behavior of falling back to v2 which can confuse error reporting. I prefer that s3fs defaults to -o sigv4 and allow users to override with -o sigv2. This will upset and break some users but v4 signatures should be well-supported 10 years after they were introduced. I also believe there are some security advantages to v4-only.

@gaul commented on GitHub (Aug 24, 2024): I also dislike the existing behavior of falling back to v2 which can confuse error reporting. I prefer that s3fs defaults to `-o sigv4` and allow users to override with `-o sigv2`. This will upset and break some users but v4 signatures should be well-supported 10 years after they were introduced. I also believe there are some security advantages to v4-only.