Do not propagate headers on HTTP redirects

问题:

I have files hosted on Amazon S3, and I'd like to download them after a treatment in my app. This app view requires the HTTP Authorization header to proceed. Here is the process:

1. Query view /file/xxx with the required Authorization request header
2. If the app access is granted, does some treatment
3. Generate a signed S3 url, and redirect to it

The fact is that the request header is also propagated on the redirect, and is in conflict with Amazon's S3 signature, I have the following error message:

Either the Signature query string parameter or the Authorization header should be specified, not both

So, is there a way to not propagate the Authorization header to S3 ?

Note that I have tested all 3xx HTTP codes. Thanks in advance.

回答1:

It may depend on your client, for example see: https://code.google.com/p/go/issues/detail?id=4800

It appears curl won't carry over your Authorization header by default. But I'm dealing with a similar issue and I see that by default http components appears to carry it.

回答2:

Is your S3 file path on the same domain as your /file/xxx? That would explain why the Authorization header is being sent, presumably. If you have your S3 hosted on a different domain to the app view, then I would assume the Authorization header would not be sent to the S3 domain (as HTTP Authorization is per-domain).