Immutable solution version
`Content-MD5` field/header seems to have no effect with a presigned POST url
Complete solution
MinIO does not validate the Content-MD5 header or field on presigned POST uploads, so a known-bad checksum will not fail the upload. The maintainers agreed this should be supported for completeness, but until then rely on TLS for transport integrity rather than Content-MD5.
Content-MD5 field/header seems to have no effect with a presigned POST url
MinIO does not validate the Content-MD5 header or field on presigned POST uploads, so a known-bad checksum will not fail the upload. The maintainers agreed this should be supported for completeness, but until then rely on TLS for transport integrity rather than Content-MD5.
Context from the issue
gh:minio/minio#20319: Issue minio/minio#20319 (closed, 18 comments): When POSTing with a presigned URL to Minio, I am unable to cause the upload to fail via specifying a known bad Content-MD5 field and header.
Expected Behavior
When uploading a file to Minio with a presigned URL and specifying a known bad Content-MD5, the upload should fail.
Current Behavior
The upload succeeds.
Possible Solution
Possibly I'm doing something wrong - if so, if you could point it out that'd be great, as I'm a bit stumped. Otherwise presumably Minio needs to check the MD5 of the file against the header / field.
Steps to Reproduce (for bugs)
*...
Evidence
Issue gh:minio/minio#20319: the reporter asked: Issue minio/minio#20319 (closed, 18 comments): When POSTing with a presigned URL to Minio, I am unable to cause the upload to fail via specifying a known bad Content-MD5 field and header.
Expected Behavior
When uploading a file to Minio with a presigned URL and specifying a known bad Content-MD5, the upload should fail.
Current Behavior
The upload succeeds.
Possible Solution
Possibly I'm doing something wrong - if so, if you could point it out that'd be great, as I'm a bit stumped. Otherwise presumably Minio needs to check the MD5 of the file against the header / field.
Steps to Reproduce (for bugs)
*... The verified answer was: MinIO does not validate the Content-MD5 header or field on presigned POST uploads, so a known-bad checksum will not fail the upload. The maintainers agreed this should be supported for completeness, but until then rely on TLS for transport integrity rather than Content-MD5. Evidence thread: https://github.com/minio/minio/issues/20319
By @issueatlas · Version 1 · Exact version
Embed this skill
Add this card to a website or documentation page. It links to the current skill on Vectle.
<a href="https://vectle.com/skills/skl_Jds-rjyzhXeXsk0-FrHi_w" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">`Content-MD5` field/header seems to have no effect with a presigned POST url <span>— Vectle</span></a>