Multi-part upload to S3 fails on Edge >= 15 with 403 Forbidden

[dpetker]

Type of issue

• Bug report
• Feature request
• Support request

Uploader type

• Traditional
• S3
• Azure

Bug Report

In Edge 15 (and presumably future versions), a content-type header is now being added to PUT requests. This becomes an issue when using an S3 uploader as Fine Uploader doesn't include content-type when creating its string to sign - so signature validation will always fail.

Fine Uploader version

5.14.4

Browsers where the bug is reproducible

Edge 15

Operating systems where the bug is reproducible

Windows 10

Exact steps required to reproduce the issue

1. Create an S3 uploader with the default chunk size (5MB), chunking.enabled = true, and signature.endpoint set
2. Select a file > 5MB to upload
3. Open F12 Developer Tools to see the PUTs to S3 fail with "403 Forbidden"

An error snippet is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
<Code>SignatureDoesNotMatch</Code>
<Message>The request signature we calculated does not match
 the signature you provided. Check your key and signing method.</Message>
<StringToSign>PUT
video/3gpp
x-amz-date:Wed, 31 May 2017 13:12:57 GMT
/path/to/my/resource
</StringToSign>
</Error>

Note that S3 is including content-type in its constructed StringToSign. No such content-type is included in the { headers: '<string to sign>' } sent to the signature.endpoint on our server.

All relevant Fine Uploader-related code that you have written

$('#foo').fineUploaderS3({
  request: {
    endpoint: 'some-url',
    accessKey: 'secret'
  },
  signature: {
    endpoint: 'our/signing/url'
  },
  chunking: {
    enabled: true
  },
  resume: {
    enabled: true
  },
  retry: {
    enableAuto: true,
    maxAutoAttempts: 10
  },
});

[rnicholus]

looks like a dupe of #1846

[dpetker]

I'm not sure that this issue is a duplicate. That PR and associated issue is related to a non-standard MIME type, while this issue is related to standard MIME types (i.e. video files) and a change in behaviour from Edge 14 to Edge 15.

Looking at the network requests in Edge 14/Chrome/FF you'll see the PUT to S3 doesn't include a content-type header (presumably because it's not required on PUT requests). Edge 15, however, decided to include it.

[rnicholus]

not really sure what is causing this issue, will require further investigation

[dpetker]

Actually, digging into the code a bit, I think the bug may lie in how you handle getFile calls on multipart uploads. XhrUploadHandler._getMimeType calls getFile using the passed in file ID which, in the case of multipart uploads, isn't an integer but a string of the format "fileId.chunkIndex" (I discovered this while developing my own workaround).

Because of that, the getFile call returns nothing so there's no way to get the MIME type. If you do something even as simple as:

getFile(parseInt(fileId, 10))

Will extract just the file ID portion and get you the file you want.

[rnicholus]

Can you open a PR?

[dpetker]

I'll see what I can do 🙂 I need to spend some more time inside the code to make sure I don't introduce any regressions.

[dpetker]

Just had a chance to verify, the fix works like a charm. Thank you!