Storage: Make HTTP-Method in signed url in upper case (and validate)

[StefMa]

1. Specify the API at the beginning of the title (for example, "BigQuery: ...")
   General, Core, and Other are also allowed as types
   ✅
2. OS type and version
   I use the Storage lib inside a Cloud Function (Python Beta runntime)
3. Python version and virtual environment information python --version
   3.7
4. google-cloud-python version pip show google-cloud, pip show google-<service> or pip freeze
   1.12.0
5. Stacktrace if available
   ❌
6. Steps to reproduce
   ❌
7. Code example
   👇

Hey guys 👋
currently I experiment a little bit with the Cloud Storage library inside a Cloud Function.
For testing I want to make an already uploaded file available via Blob#generate_signed_url.
The thing is - it works. I have no issues.
But Yesterday I spend at least 6 hours for testing it because the method in the generated_signed_url needs to be in uppercase.
Meaning the following does not work:

blob.generate_signed_url(timedelta(minutes=5), "get")

but this works:

blob.generate_signed_url(timedelta(minutes=5), "GET")

After a quick look into your code I found out that you "just put" the string into the generated URL. Without validating if that is a valid HTTP-Method!
https://github.com/GoogleCloudPlatform/google-cloud-python/blob/81bc5ef11d1918580f41e9f8ee2c9be2529b1169/storage/google/cloud/storage/_signing.py#L189

I would recommend (or request with this issue 🙃 ) to either:

• Check if the given string is a valid HTTP-Method (POST, GET, PUT etc.) and make the string to uppercase!
• Or better (but leads to breaking changes (maybe 😃)) make an ENUM of it and only allow to put an enum-value into the method.

[tseaver]

I can see making the method uppercase (because the backend requires it), but enforcing a valid verb is not reasonable: we would have to track the set of verbs allowed over time by the back end.

[StefMa]

What will possibility change on the http method in the backend over time? 🤔 I mean, we have currently a hand full PC http methods. I think it is a big announcement in the community when a new http method get introduced. And then we have to track the backend when it will implement it. But I think this will not change that often that it is not worth to check in this library.

…

On Wed, Sep 26, 2018, 4:51 PM Tres Seaver ***@***.***> wrote: I can see making the method uppercase (because the backend requires it), but enforcing a valid verb is not reasonable: we would have to track the set of verbs allowed over time by the back end. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#6107 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AJwYe_hlmVaVIMpe-ZIXVtMoYUdFvUpyks5ue5R_gaJpZM4W5_OC> .