Verifies AWS Signature Version 4 from either the Authorization header or presigned URL query parameters (X-Amz-Algorithm, X-Amz-Credential, X-Amz-Signature, etc.). Reconstructs the canonical request + string-to-sign and derives the signing key via the HMAC-SHA256 chain:

secret → dateKey → dateRegionKey → dateRegionServiceKey → signingKey

The signing key is derived per request rather than cached so the timing of known-vs-unknown access keys remains constant. Header auth: ±15 minute clock skew tolerance. Presigned URLs: expiry enforced via X-Amz-Expires (max 7 days).

The canonical URI is taken from the request's wire form (r.URL.RawPath, falling back to r.URL.Path when the URL parser preserved the encoding verbatim) so percent-encoded path segments are matched byte-for-byte. Object keys containing %2F (a literal / as part of the key, not a directory separator) round-trip correctly through the AWS SDK signers, and an upstream proxy that normalises one encoding to another after the client signed cannot have the substituted form silently accepted.

Streaming-payload PUTs (STREAMING-AWS4-HMAC-SHA256-PAYLOAD, STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER, STREAMING-UNSIGNED-PAYLOAD-TRAILER) are supported: the seed signature in the Authorization header authenticates the request envelope, and a chunk-validating reader takes over the request body to verify each chained per-chunk signature (or the trailer signature for the unsigned-trailer variant) before bytes reach storage.

Also supports legacy X-Proxy-Token header for simple clients.

Color	Meaning
Forest green	Entry point
Green border	Decision / routing
Teal fill	Concurrency pool (semaphore)
Gray	Processing step
Red	Rejection (4xx/5xx)
Green	Success / read operation
Teal	Write operation
Amber	Circuit breaker

Admission Control Flow

Legend