fix: canonical request path if empty choose '/'

additionally this PR allows content-type and
content-length to be part of signed headers as
this is allowed in signature v4.

minio/credentials/providers.py

@@ -115,6 +115,7 @@ def __init__(
         self._body = urlencode(query_params)
         self._content_sha256 = sha256_hash(self._body)
         url = urlsplit(sts_endpoint)
+        self._url = url
         self._host = url.netloc
         if (
                 (url.scheme == "http" and url.port == 80) or
@@ -131,7 +132,7 @@ def retrieve(self):
         utctime = utcnow()
         headers = sign_v4_sts(
             "POST",
-            urlsplit(self._sts_endpoint),
+            self._url,
             self._region,
             {
                 "Content-Type": "application/x-www-form-urlencoded",

minio/signer.py

@@ -58,8 +58,8 @@ def _get_canonical_headers(headers):
     for key, values in headers.items():
         key = key.lower()
         if key not in (
-                "authorization", "content-type",
-                "content-length", "user-agent",
+                "authorization",
+                "user-agent",
         ):
             values = values if isinstance(values, (list, tuple)) else [values]
             canonical_headers[key] = ",".join([
@@ -91,7 +91,6 @@ def _get_canonical_request_hash(method, url, headers, content_sha256):
     """Get canonical request hash."""
     canonical_headers, signed_headers = _get_canonical_headers(headers)
     canonical_query_string = _get_canonical_query_string(url.query)
-
     # CanonicalRequest =
     #   HTTPRequestMethod + '\n' +
     #   CanonicalURI + '\n' +
@@ -101,7 +100,7 @@ def _get_canonical_request_hash(method, url, headers, content_sha256):
     #   HexEncode(Hash(RequestPayload))
     canonical_request = (
         f"{method}\n"
-        f"{url.path}\n"
+        f"{url.path or '/'}\n"
         f"{canonical_query_string}\n"
         f"{canonical_headers}\n\n"
         f"{signed_headers}\n"