https://silo.pgsty.com/tags/presigned/ Recent content in Presigned on SILO Hugo en Sun, 13 Sep 2026 10:59:52 +0800 https://silo.pgsty.com/blog/design/signed-header-coverage/ Wed, 09 Sep 2026 00:00:00 +0000 https://silo.pgsty.com/blog/design/signed-header-coverage/ A presigned or signed PUT authorized for one object could be turned into a server-side copy of any object the signing key can read, because SigV4 verification only walked the list of signed header names and never the x-amz-* headers that actually arrived, while the router selects CopyObject from an unsigned x-amz-copy-source header. This record defines SILO’s unsigned-header rejection boundary, the payload-hash exception and trusted signature-age derivation, the PutObjectTagging injection reorder, the scope across signature modes, and the release evidence.