Files
4a0c147c50 fix(storage): support GCS S3 XML API signing (MUL-8232) (#9513)
* fix(storage): omit unsigned headers from SigV4 to support GCS S3 XML API

Google Cloud Storage through its S3-compatible XML API mutates the
Accept-Encoding request header in transit (identity -> identity,gzip(gfe)).
Because aws-sdk-go-v2 signs Accept-Encoding into SignedHeaders by default,
this mutation causes HTTP 403 SignatureDoesNotMatch on storage calls.

This commit:
- Automatically excludes accept-encoding from SigV4 signing when
  AWS_ENDPOINT_URL points to Google Cloud Storage (storage.googleapis.com).
- Adds S3_UNSIGNED_HEADERS to configure additional unsigned headers,
  preserving accept-encoding when targeting GCS.
- Strips unsigned headers prior to SigV4 signing while restoring captured
  headers (including Accept-Encoding: identity) on the wire via an HTTP
  client wrapper.
- Documents S3_UNSIGNED_HEADERS across all 5 documentation translations
  (en, zh, ja, ko, fr) with an integrity protection note.
- Adds regression tests for SigV4 omission, wire transmission, and presigned
  X-Amz-SignedHeaders.

Closes #9509

* fix(storage): scope GCS signing workaround to Accept-Encoding (MUL-8232)

Co-authored-by: multica-agent <[email protected]>

---------

Co-authored-by: Sol-Boy <[email protected]>
Co-authored-by: multica-agent <[email protected]>
2026-10-28 17:02:10 +08:00
..