[Bug]: S3 Presigned GET ignores expiration, can be accessed beyond expiration date #9599
Description
What happened?
What actually happened, including error codes if applies.
Steps to Reproduce:
- Put object on LakeFS branch
- Create presigned url with
obstore:
import obstore as obs
from obstore.store import S3Store
store = S3Store(
bucket=self.bucket,
prefix=self.prefix,
endpoint=self.endpoint, # type: ignore
access_key_id=self.access_key_id, # type: ignore
secret_access_key=self.secret_access_key, # type: ignore
)
url = obs.sign(
store=store,
paths=paths,
method="GET",
expires_in=timedelta(minutes=1),
)- Use url after couple minutes, normally it should reject it now but lakefs doesn't reject it.
Expected behavior
Respect the expiration date of the presigned url.
lakeFS version
1.68.0
How lakeFS is installed
kubernetes
Affected clients
No response
Relevant log output
Contact details
No response