--aws-sigv4 doesn't sort query string parameters before signing #9717
Description
SigV4 specification says that the query string parameters must be sorted before signing:
To construct the canonical query string, complete the following steps:
Sort the parameter names by character code point in ascending order. [...]
But curl doesn't do that.
I've run the following command and got a signature-related error:
> curl --aws-sigv4 "aws:amz:us-east-1:es" --user "<AccessKeyId>:<SecretAccessKey>" --header "X-Amz-Security-Token:<SessionToken>" \
-X POST 'https://<endpoint>/<index>/_search?sort=_doc&size=50' \
-H "Content-Type: application/json" --data-raw $'<query>'
{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."}
However if I manually write the query string parameters in alphabetical order it works:
> curl --aws-sigv4 "aws:amz:us-east-1:es" --user "<AccessKeyId>:<SecretAccessKey>" --header "X-Amz-Security-Token:<SessionToken>" \
-X POST 'https://<endpoint>/<index>/_search?size=50&sort=_doc' \
-H "Content-Type: application/json" --data-raw $'<query>'
{...successful response...}
curl/libcurl version
> curl -V output
curl 7.76.1 (x86_64-koji-linux-gnu) libcurl/7.76.1 OpenSSL/1.0.2k-fips zlib/1.2.7 libidn2/2.3.0 libssh2/1.4.3 nghttp2/1.41.0
operating system
MacOS Monterey 12.6