Always getting SignatureDoesNotMatch error for get_presigned_url for file upload

[AlexanderPershin]

Expected Behavior

When function get_presigned_url called with argument method = 'PUT' correctly signed URL created, which when pasted in browser allows to upload the file

Current Behavior

The error message returned instead of the file upload:

<Error>
<Code>SignatureDoesNotMatch</Code>
<Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>
<Key>...omitted</Key>
<BucketName>...</BucketName>
<Resource>/.../video1</Resource>
<RequestId>...</RequestId>
<HostId>...</HostId>
</Error>

Possible Solution

Min.io configuration change, adding nginx proxy server

Steps to Reproduce (for bugs)

1. Install and start Min.io on Linux machine (mine is Fedora 39)
2. The script to start Min.io server is start_minio.sh

#!/bin/bash
MINIO_ROOT_USER=admin MINIO_ROOT_PASSWORD=password minio server /opt/minio --console-address :9001

3. Run the script main.py to upload the file:

import logging
from minio import Minio
import datetime

logging.basicConfig(level=logging.DEBUG)

logger = logging.getLogger(__name__)

LOGGER_PREFIX = "MINIO_WITHOUT_DOCKER"

def main():
    ACCESS_KEY = "admin"
    SECRET_KEY = "password"
    MINIO_API_HOST = "localhost:9000"

    merchant_id = "test_bucket"

    client = Minio(MINIO_API_HOST, ACCESS_KEY, SECRET_KEY, secure=False)

    found = client.bucket_exists(merchant_id)
    if not found:
        client.make_bucket(merchant_id)
    else:
        logger.debug(f"{LOGGER_PREFIX}: Bucket {merchant_id} already exists")

    url = client.get_presigned_url(
        "PUT", merchant_id, "test.md", expires=datetime.timedelta(hours=5)
    )

    logger.debug(f"{LOGGER_PREFIX}: url == {url}")

if __name__ == "__main__":
    main()

4. Open URL from terminal in browser and see the error

Context

I'm trying to create video streaming service, where files should be uploaded directly to Min.io using presigned_url

Your Environment

• Version used (minio --version):

minio version RELEASE.2024-05-10T01-41-38Z (commit-id=b5984027386ec1e55c504d27f42ef40a189cdb55)
Runtime: go1.22.3 linux/amd64
License: GNU AGPLv3 - https://www.gnu.org/licenses/agpl-3.0.html
Copyright: 2015-2024 MinIO, Inc.

• Server setup and configuration:
  Min.io running locally on my machine
• Operating System and version:
  Fedora 39, kernel 6.8.9-200.fc39.x86_64 (64-bit)

[AlexanderPershin]

Also, I'm getting the same behavior in production, when Flask app creates presigned_url from inside of the Docker container and Min.io server runs on Linux OS without Docker

[klauspost]

Most likely your host name is changed in the request.

[AlexanderPershin]

I'm not sure how that's possible, I'm using python SDK and there is only one option on how to call get_presigned_url for file uploading. Do you have any ideas on how I could fix this?

[zanzlender]

Although I can't see the solution for the first one, be careful when using docker "localhost" is not your computer's "localhost", but a separate one inside the docker container itself... Did you try to run both inside a docker-compose?

[AlexanderPershin]

Yep, I used extra_hosts

    extra_hosts:
      - "host.docker.internal:host-gateway"

But then it creates presigned_url with host.docker.internal domain in it. That's for the use case when Flask is running in docker container and Min.io deployed on server OS directly without docker. I decided not to put Min.io inside of the docker container, because it created even more issues