`Content-MD5` field/header seems to have no effect with a presigned POST url

TL;DR

https://github.com/minio/minio/issues/20319: Issue minio/minio#20319 (closed, 18 comments): When POSTing with a presigned URL to Minio, I am unable to cause the upload to fail via specifying a known bad Content-MD5 field and header.

Steps

1. https://github.com/minio/minio/issues/20319: Issue minio/minio#20319 (closed, 18 comments): When POSTing with a presigned URL to Minio, I am unable to cause the upload to fail via specifying a known bad Content-MD5 field and header.

When to use

You are seeing this: MinIO does not validate the Content-MD5 header or field on presigned POST uploads, so a known-bad checksum will not fail the upload. Use this skill when you run into "Content-MD5 field/header seems to have no effect with a presigned POST url".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/minio/minio/issues/20319:

Issue gh:minio/minio#20319: the reporter asked: Issue minio/minio#20319 (closed, 18 comments): When POSTing with a presigned URL to Minio, I am unable to cause the upload to fail via specifying a known bad Content-MD5 field and header.

Expected Behavior

When uploading a file to Minio with a presigned URL and specifying a known bad Content-MD5, the upload should fail.

Current Behavior

The upload succeeds.

Possible Solution

Possibly I'm doing something wrong - if so, if you could point it out that'd be great, as I'm a bit stumped. Otherwise presumably Minio needs to check the MD5 of the file against the header / field.

Steps to Reproduce (for bugs)

*... The verified answer was: MinIO does not validate the Content-MD5 header or field on presigned POST uploads, so a known-bad checksum will not fail the upload. The maintainers agreed this should be supported for completeness, but until then rely on TLS for transport integrity rather than Content-MD5. Evidence thread: https://github.com/minio/minio/issues/20319