Affects: 5.3.10
When a call is redirected to AWS, the following message is given:
<Error><Code>InvalidArgument</Code><Message>Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified</Message><ArgumentName>Authorization</ArgumentName><ArgumentValue>Bearer 89QdsFtUXcgUKuMOgOVeCB</ArgumentValue><RequestId>XFJWT7AF8Q87Q5JC</RequestId><HostId>jofrQNGeH1bj2v5KrmcD0BBlqpy78iXk0D80Q1sI6oBl4TUXvFIzbV138t0V7Ua2T4Ms555aWuk=</HostId></Error>
The reason for this is that the original call is using a bearer token and when the call is redirected to AWS, the header with the bearer token gets copied.
Comment From: pasi-paasiala
This seems to be done in the Apache client. Don't know if updating to the latest client would make any difference here.
Comment From: bclozel
Spring Framework has no required dependency on the Apache client. If you believe this is a bug, could you report this problem to the Apache client project directly?
Comment From: pasi-paasiala
Spring Framework has no required dependency on the Apache client. If you believe this is a bug, could you report this problem to the Apache client project directly?
@bclozel HttpComponentsClietHttpRequest seems to use Apache HttpClient.
Comment From: bclozel
What I meant is: if your project depends on Spring Framework, Spring itself doesn't transitively depends on that library - your project does.
Don't know if updating to the latest client would make any difference here.
Since you've found that the related code lives in the library itself (and to me it doesn't seem that Spring is configuring the client that way), then it should be either improved in the client directly or the library upgrade you're pointing at should happen in your project directly.
In any case, we'd be happy to reopen this issue if there's anything we can do; from what you've found it doesn't seem the case.
Comment From: pasi-paasiala
I'm not an expert on this. Just debugged that this happens and trying to find my way around this. I agree that it should be improved in the Apache library and was thinking, if the new version of Apache http client already works better. At least, when I looked at the code, it didn't seem to have copying of headers in the new version.
Comment From: bclozel
Spring Framework also supports this version. Have you tried upgrading your project?
Comment From: pasi-paasiala
According to this, the support doesn't exist. The classpaths differ between Apache http client 4 and 5, so you cannot switch by just changing the dependency.
Am I missing something?
Comment From: bclozel
Right, my bad.
Spring Framework is supporting Apache HttpComponents 5 client, but with WebClient using the HttpComponentsClientHttpConnector. RestTemplate is in maintenance mode these days so we don't add new features to this part of the codebase.