Conversation
…udFront OAC CloudFront OAC (Origin Access Control) requires the x-amz-content-sha256 header to be present when forwarding POST requests with a body to Lambda Function URLs using AWS_IAM auth. Without it, CloudFront cannot include the correct payload hash in its Sig V4 signature, causing an InvalidSignatureException (HTTP 403). This is the browser-side counterpart of the CLI fix in src/review-client.ts (issue minorun365#4). The body hash is computed using the Web Crypto API (crypto.subtle.digest) which is available in all modern browsers. Fixes: POST /api/owner/shares returning 403 when using the dashboard to generate share URLs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
問題
ダッシュボードから共有URLを発行しようとすると
POST /api/owner/sharesが HTTP 403 (InvalidSignatureException) で失敗する。原因
CloudFront OAC は Lambda Function URL へのリクエストを Sig V4 で署名する際、ペイロードハッシュの値として
x-amz-content-sha256ヘッダーを参照する。このヘッダーがない場合、ボディありの POST に対して正しい署名を生成できず 403 が返る。GETリクエストやボディなしの POST は問題なく通るが、ボディありの POST のみ失敗するのはこのためで、CloudFront OAC の既知の挙動です。
#4 との関係
#4 では
src/review-client.ts（CLIパス）に同じ修正が入っていますが、ブラウザ側（web/app/index.htmlおよびweb/mobile-page-shell.js）には適用されていませんでした。本PRはその対応です。ブラウザ環境では Node.js の
createHashが使えないため、Web Crypto API（crypto.subtle.digest）で SHA-256 ハッシュを計算しています。修正内容
web/app/index.html—buildTimedShareUrl内の fetch にx-amz-content-sha256を追加web/mobile-page-shell.js— 共有URL発行処理の fetch に同ヘッダーを追加検証
OAC +
authType: AWS_IAMの構成で実際にデプロイした環境にて、修正後にPOST /api/owner/sharesが 201 で正常に完了し、共有URLが発行できることを確認済みです。Claude Code を使って根本原因を調査・特定し、この修正に至りました。