Use sha256 instead of md5 to check file integrity, while putting object to S3 with presigned url

[yemchenko-dan]

I want to implement direct uploading of files to s3 with presigned urls.
Here's how I would do this:

::Aws::S3::Presigner has option to add content_md5 header to a presigned url.
It is well known, that md5 file algorithm is vulnerable to collisions.
There are modern alternatives, for example sha256, which are stronger.

Is it possible to use one of those to create presigned urls?

[mullermp]

Pre-signed requests and urls for put_object should support all of the available options: https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/S3/Client.html#put_object-instance_method

There are options for checksum_algorithm for selecting CRC32/C and SHA1/256 options, and options for taking the digest. The SDK will calculate this value. I believe the SDK will validate it for you when downloading the file, though that wouldn't be done in a presigned request.

[yemchenko-dan]

Thanks for your timely answer.

For everybody, who wanders how to use the API exactly. Here's an example:

key = SecureRandom.uuid
url = ::Aws::S3::Presigner.new.presigned_url(
        :put_object,
        bucket: 'your bucket',
        key: key,
        expires_in: 300,
        checksum_algorithm: 'SHA256',
        checksum_sha256: 'file sha',
        content_type: 'file content-type'
      )

To test with curl

curl -X PUT -H "Content_SHA256: file sha" -H "Content-Type: file type" --upload-file your_file "here goes the url from presigner"