joyent/node-manta — pull request #84 by Marsell (2013-07-11 14:48:35+00:00)
Title: MantaClient signURL() disobeys optional algorithm arg

The current code for signURL() in lib/client.js contains this:

var _opts = {
algorithm: opts.algorithm || self.sign.algorithm,
...
sign: self.sign,
...
};

Note that I can provide an alternate algorithm, but not sign. This becomes a problem because signUrl() in lib/auth.js doesn't actually obey any algorithm argument for the signing itself, it uses sign.

So this:

client.signURL({ path: '/marsell/stor/foobar', expires: 1374047343, algorithm: 'rsa-sha1' }, function (err, url) {
...
});

Will generate a signed URL claiming to be &algorithm=rsa-sha1, when it's likely something else (whatever was used during client construction). In my case, it claims to be rsa-sha1, when it's actually rsa-sha256 that was used for signing.

I think the correct fix here is to remove the _algorithm_ optional arg from both signURL and signUrl, and allow users of signURL to provide their own sign arg. Anything else is asking for unnecessary trouble.