[kmcginnes]

Summary

Neptune accepts only HTTPS, so an IAM-authenticated connection with an http:// Database URL can't work. The proxy server now fails it up front with an error that names the fix.

User-facing: A connection with IAM authentication on and an http:// Database URL shows "IAM authentication needs an https:// Database URL…" instead of a failed request. Connections without IAM, such as Gremlin Server over http://, are unchanged.

parseDbQueryHeaders
  assertPermittedDbOrigin
+ assertHttpsForIamSigning   # only when IAM is on; 400 if the URL is http://

Every forwarding route and both cancel paths go through parseDbQueryHeaders, so the Default Connection with IAM=true is covered too.

Evidence

Before: the proxy sent the IAM request to the http:// URL.
After: a 400 with the fix message, and nothing is sent to the database. Tests cover each forwarding route, plus an unsigned http:// request that still goes through.

Verified live: all six forwarding routes plus the cancel path against a local proxy and a throwaway fake database over http://.

Merge Danger

Door: two-way

Impact: IAM connections with an http:// URL now fail with a clear error; Neptune endpoints use https://, so they don't change.

Upgrade note

• IAM authentication needs https://. A connection with IAM authentication on and an http:// Database URL now fails with an error that names the fix, instead of sending the request. Neptune endpoints use https://, so Neptune connections don't change.

Related

• Closes Require HTTPS for IAM-signed requests #2463

[kmcginnes]

Approved