Repository navigation
A request outside the 15 minute SigV4 window gets UnrecognizedClientException; DynamoDB answers InvalidSignatureException #805
Description
Summary
When X-Amz-Date is more than 15 minutes from the clock, DynamoDB refuses the request with InvalidSignatureException, and its message names the side of the window and the times it compared. ExtendDB answers UnrecognizedClientException, with one message for both sides.
X-Amz-Date |
DynamoDB (us-east-1, measured 2026-11-03) | ExtendDB (main 5a1d4d7, from crates/auth/src/sigv4/verify.rs) |
|---|---|---|
| 16 minutes before the clock | 400 InvalidSignatureException Signature expired: 20261103T201550Z is now earlier than 20261103T201650Z (20261103T203150Z - 15 min.) |
400 UnrecognizedClientException Signature expired: the signature is too old or the request date is too far in the future. |
| 16 minutes after the clock | 400 InvalidSignatureException Signature not yet current: 20261103T204750Z is still later than 20261103T204650Z (20261103T203150Z + 15 min.) |
400 UnrecognizedClientException, the same message as the row above |
In both DynamoDB messages the first time is X-Amz-Date, the second is the edge of the window, and the third is the service's clock.
Each case was a ListTables request, sent twice in each of two forms:
- signed with a clock 16 minutes off, so the signature matches its own date
- signed at the current time, with
X-Amz-Datereplaced afterwards, so the signature no longer matches
Both forms got the answers above. DynamoDB checks the time before it compares the signature. So does ExtendDB: validate_timestamp runs before verify_signature.
Cause
validate_timestamp in crates/auth/src/sigv4/verify.rs returns UnrecognizedClientException with one fixed message for both sides of the window.
Fix shape
Return InvalidSignatureException with the two messages, built from X-Amz-Date and the server's clock. No test on main checks the error or the message for these requests. The outside_the_skew_window cases in #792 check only that the time check refuses these requests, with either error and any message; after this fix they can check the error and the message too. A test in #512 checks that the message for a date an hour old starts with "Signature expired". DynamoDB's message for a past date starts the same way, so that test still passes after the fix.
Raised in the review of #792.
Activity
test(auth): require the time check for requests outside the skew window