4 ms·

famous example of this, are most of the aws api's that because of their signing features and hashes can really only be called sanely from an sdk. such a pain t

by aszen 5y ago

famous example of this, are most of the aws api's that because of their signing features and hashes can really only be called sanely from an sdk. such a pain to debug, i'm not sure why they have such signing features. is it for security

dragonwriter 5y ago
> is it for security Yes. EDIT: specifically, it is do intercepting a request doesn’t allow you to issue new requests.
- aszen 5y ago
  Isn't that what https provides. Or were the APIs creates before https was popular
  - j16sdiz 5y ago
    The use case is different. For example, S3. S3’s authentication scheme allow you create a limited used download link and passing to a untrusted user
marcosdumay 5y ago
> is it for security It is because TLS client certificates do not exist.
nexuist 5y ago
I would say it is fair for AWS to have a complicated signing method, because you really do not want your AWS account falling into the wrong hands or being intercepted through some MITM attack. With an AWS account an attacker can bankrupt you pretty much instantly.