Credential caching

[itamarwe]

I'm using the AWS-SDK with several sets of credentials. I use this code to test if the credentials are correct and if they have the right permissions. I see a strange caching of the credentials when switching between the different credentials.

Here's an example code:

AWS     = require 'aws-sdk'

correctCredentials = '...' #these are correct credentials
wrongCredentials = '...' #these are wrong credentials

s3Correct = new AWS.S3
  credentials: correctCredentials

s3Wrong = new AWS.S3
  credentials: wrongCredentials

params =
  Bucket: 'mybucket'

s3Correct.listObjectsV2 params, (err, data)=>
  if err?
    console.log err
  unless err?
    console.log 'no error'

s3Wrong.listObjectsV2 params, (err, data)=>
  if err?
    console.log err
  unless err?
    console.log 'no error'

On version 2.3.19 of the SDK I get no error on the correct credentials and an error on the wrong credentials, while with version 2.4.6 I get no errors on both.

It seems that while I don't change the awsAccessKeyId, the SDK caches the awsSecretAccessKey.

[chrisradek]

@itamarwe
With version 2.4.0 of the SDK, S3 was updated to use signatureVersion: 'v4' by default, where previously it used signatureVersion: 'v2'. One consequence of this is that the signature used to sign requests is cached by default:
http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Config.html#signatureCache-property

The logic that decides whether to use the cache compares the date (YYYY-MM-DD), service, accessKeyId, and region. So, if 2 service clients shared all of the above, they would use the same signature for signing as well.

This looks related to #1020.

The risk of your example happening in a real application should be extremely low since access keys consist of a pair of accessKeyId and secretAccessKey, and would likely be the result of specifically using 2 different credentials where one was incorrectly configured. It's still weird behavior though. I worked on a PR for #1020 that I'll post that will address that as well.

[itamarwe]

@chrisradek The probability of this happening is not extremely low. It is 100% in any application that asks users to enter their AWS credentials. This is a very strange behavior with a very unexpected side-effect and I'm greatful for our automatic testing that discovered it.

It should be made very clear that this caching exists.

Anyway, it seems that I managed to solve the issues by instantiating the service as follows:

s3 = new AWS.S3
  credentials: credentials
  signatureCache: false

Thanks.

[chrisradek]

@itamarwe
PR #1054 was created that will prevent 2 service clients from sharing a cache. We'll be working to merge this soon.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.