Colleen Murphy 8d5becbe4b Check timestamp of signed EC2 token request ... EC2 token requests contain a signature that signs the entire request, including the access timestamp. While the signature is checked, the timestamp is not, and so these signed requests remain valid indefinitely, leaving the token API vulnerable to replay attacks. This change introduces a configurable TTL for signed token requests and ensures that the timestamp is actually validated against it. The check will work for either an AWS Signature v1/v2 'Timestamp' parameter[1] or the AWS Signature v4 'X-Aws-Date' header or parameter[2]. Although this technically adds a new feature and the default value of the feature changes behavior, this change is required to protect credential holders and therefore must be backported to all supported branches. [1] https://docs.aws.amazon.com/general/latest/gr/signature-version-2.html [2] https://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html Change-Id: Idb10267338b4204b435df233c636046a1ce5711f Closes-bug: #1872737 (cherry picked from commit ab89ea7490)		2020-04-30 20:25:13 +00:00
..
EC2_S3_Resource.py	Check timestamp of signed EC2 token request	2020-04-30 20:25:13 +00:00
__init__.py	Convert role_inferences API to flask native dispatching	2018-08-13 20:06:35 +00:00
authentication.py	Remove six usage	2020-01-30 06:06:51 +00:00
implied_roles.py	Convert role_inferences API to flask native dispatching	2018-08-13 20:06:35 +00:00
json_home_relations.py	Convert S3 and EC2 auth to flask native dispatching	2018-10-11 15:27:46 -07:00
saml.py	Add openstack_groups to assertion	2020-03-19 20:14:41 +05:30