@@ -67,14 +67,22 @@ def build_auth_token(api_client, db_user, instance_id, expires=None):
6767 request .service = DEFAULT_SERVICE
6868 request .is_presign = True
6969
70- # Create interceptor chain:
71- # ResolveEndpointInterceptor - resolves endpoint + scheme
72- # SignRequestInterceptor - presign URL signing
73- chain = InterceptorChain ()
74- chain .append_request_interceptor (ResolveEndpointInterceptor ())
75- chain .append_request_interceptor (SignRequestInterceptor ())
76-
7770 context = InterceptorContext (request = request )
78- context = chain .execute_request (context )
7971
80- return '{url}?{query}' .format (url = context .request .url , query = context .request .signed_query )
72+ # Step 1: Resolve endpoint to get host
73+ resolve_chain = InterceptorChain ()
74+ resolve_chain .append_request_interceptor (ResolveEndpointInterceptor ())
75+ context = resolve_chain .execute_request (context )
76+
77+ # Step 2: Save resolved host to X-Host query param, then clear host so it won't be signed
78+ resolved_host = context .request .host
79+ context .request .query_params ['X-Host' ] = '{scheme}://{host}' .format (
80+ scheme = context .request .scheme , host = resolved_host )
81+ context .request .host = None
82+
83+ # Step 3: Sign request (host is None, won't be included in signature)
84+ sign_chain = InterceptorChain ()
85+ sign_chain .append_request_interceptor (SignRequestInterceptor ())
86+ context = sign_chain .execute_request (context )
87+
88+ return context .request .signed_query
0 commit comments