diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2021-02-12 10:27:42 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2021-02-13 22:36:15 +0100 |
| commit | 46620b97431e19c53ce82e55055c85830f088cf4 (patch) | |
| tree | 672f1b6b90b0dc5dc2693df105ab010def1cd35a /lib/http_aws_sigv4.c | |
| parent | e992770e8d16e4be2a3da8aa2cef5cfc12e22372 (diff) | |
| download | curl-46620b97431e19c53ce82e55055c85830f088cf4.tar.gz | |
http: use credentials from transfer, not connection
HTTP auth "accidentally" worked before this cleanup since the code would
always overwrite the connection credentials with the credentials from
the most recent transfer and since HTTP auth is typically done first
thing, this has not been an issue. It was still wrong and subject to
possible race conditions or future breakage if the sequence of functions
would change.
The data.set.str[] strings MUST remain unmodified exactly as set by the
user, and the credentials to use internally are instead set/updated in
state.aptr.*
Added test 675 to verify different credentials used in two requests done
over a reused HTTP connection, which previously behaved wrongly.
Fixes #6542
Closes #6545
Diffstat (limited to 'lib/http_aws_sigv4.c')
| -rw-r--r-- | lib/http_aws_sigv4.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/http_aws_sigv4.c b/lib/http_aws_sigv4.c index 8fd1c77e6..a04b46a35 100644 --- a/lib/http_aws_sigv4.c +++ b/lib/http_aws_sigv4.c @@ -99,8 +99,8 @@ CURLcode Curl_output_aws_sigv4(struct Curl_easy *data, bool proxy) char *request_type = NULL; char *credential_scope = NULL; char *str_to_sign = NULL; - const char *user = conn->user ? conn->user : ""; - const char *passwd = conn->passwd ? conn->passwd : ""; + const char *user = data->state.aptr.user ? data->state.aptr.user : ""; + const char *passwd = data->state.aptr.passwd ? data->state.aptr.passwd : ""; char *secret = NULL; unsigned char tmp_sign0[32] = {0}; unsigned char tmp_sign1[32] = {0}; |