[Bug]: Fehler: Error executing "DeleteObjects" - Missing Content-Md5 - S3 Storage

[Kiter1988]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I have connected my nextcloud with an external Storage. Strato S3 Object Storage.
I can create files an folders.
I cant delete folders

[files_external] Fehler: Error executing "DeleteObjects" on "https://s3.hidrive.strato.com/bucketname?delete"; AWS HTTP error: Client error: `POST https://s3.hidrive.strato.com/bucketname?delete` resulted in a `400 Bad Request` response:
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>MissingContentMD5</Code><Message>Missing required header for this re (truncated...)
 MissingContentMD5 (client): Missing required header for this request: Content-Md5. - <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>MissingContentMD5</Code><Message>Missing required header for this request: Content-Md5.</Message><Key>/bucketname</Key><RequestId>only an id</RequestId></Error>
	DELETE /remote.php/dav/files/admin/randompath

Steps to reproduce

1. connect to Strato S3 Object Storage with "external Storage" App
2. create a folder
3. try to delete it.

Expected behavior

normal procedure für deleting files and folders without errors

Nextcloud Server version

32

Operating system

Other

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{    "system": {        "instanceid": "***REMOVED SENSITIVE VALUE***",        "passwordsalt": "***REMOVED SENSITIVE VALUE***",        "secret": "***REMOVED SENSITIVE VALUE***",        "trusted_domains": [            "my-url"        ],        "datadirectory": "***REMOVED SENSITIVE VALUE***",        "overwrite.cli.url": "https:\/\/my-url",        "overwriteprotocol": "https",        "dbtype": "mysql",        "version": "32.0.1.2",        "dbname": "***REMOVED SENSITIVE VALUE***",        "dbhost": "***REMOVED SENSITIVE VALUE***",        "dbport": "",        "dbtableprefix": "oc_",        "dbuser": "***REMOVED SENSITIVE VALUE***",        "dbpassword": "***REMOVED SENSITIVE VALUE***",        "installed": true,        "maintenance": false,        "mail_from_address": "***REMOVED SENSITIVE VALUE***",        "mail_smtpmode": "smtp",        "mail_domain": "***REMOVED SENSITIVE VALUE***",        "maintenance_window_start": 2,        "theme": "",        "log_type": "file",        "logfile": "\/home\/user_name\/nextcloud_log\/nextcloud.log",        "loglevel": 2,        "log_rotate_size": 52428800,        "logdateformat": "F d, Y H:i:s",        "tempdirectory": "\/home\/user_name\/tmp",        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",        "mail_smtpport": "465",        "updater.release.channel": "stable",        "mail_sendmailmode": "smtp",        "appstoreenabled": true,        "appstoreurl": "https:\/\/apps.nextcloud.com\/api\/v1",        "app_install_overwrite": {            "0": "occweb",            "1": "issuetemplate",            "2": "documentserver_community",            "3": "hsts",            "4": "caniupdate",            "7": "files_photospheres",            "8": "jsloader",            "9": "geoblocker",            "10": "imageconverter",            "12": "side_menu"        },        "encryption.key_storage_migrated": false,        "default_phone_region": "DE",        "default_language": "de",        "force_locale": "de_DE",        "mysql.utf8mb4": true,        "defaultapp": "files",        "mail_smtpauth": 1,        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",        "mail_smtpsecure": "ssl",        "mail_smtpauthtype": "LOGIN",        "skeletondirectory": "",        "enable_previews": true,        "preview_max_x": 800,        "preview_max_y": 800,        "memcache.local": "\\OC\\Memcache\\APCu",        "dav.max_requests_per_minute": 5,        "telemetry.enabled": false,        "config_preset": 3    }}

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

[files_external] Fehler: Error executing "DeleteObjects" on "https://s3.hidrive.strato.com/bucketname?delete"; AWS HTTP error: Client error: `POST https://s3.hidrive.strato.com/bucketname?delete` resulted in a `400 Bad Request` response:
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>MissingContentMD5</Code><Message>Missing required header for this re (truncated...)
 MissingContentMD5 (client): Missing required header for this request: Content-Md5. - <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>MissingContentMD5</Code><Message>Missing required header for this request: Content-Md5.</Message><Key>/bucketname</Key><RequestId>only an id</RequestId></Error>
	DELETE /remote.php/dav/files/admin/randompath

Additional info

Strato Support Answer

English

`We have noticed that the AWS SDK now uses a new hash algorithm for DELETE requests. This is already supported by Amazon, but not yet by our service. This led to errors because our system expects the previous MD5 hash, which is no longer included in the new request. We plan to implement support for the new hash in the future.

In the log data, we can see that you tested various authorisations. The SignedV2 requests failed with the message

“The request signature we calculated does not match the signature you provided. Check your key and signing method.”

The SignedV4 requests, on the other hand, were missing the header

‘Missing required header for this request: Content-Md5.’

This indicates a configuration deviation on the client side.

)`

German:

Wir konnten feststellen, dass das AWS SDK inzwischen bei DELETE-Requests einen neuen Hash-Algorithmus verwendet. Dieser wird von Amazon bereits unterstützt, jedoch aktuell noch nicht von unserem Dienst. Deshalb kam es zu Fehlern, da unser System den bisherigen MD5-Hash erwartet, der im neuen Request nicht mehr enthalten ist. Wir planen, die Unterstützung des neuen Hashes künftig ebenfalls zu implementieren.

In den Logdaten sehen wir, dass Sie verschiedene Autorisierungen getestet haben. Die SignedV2-Requests scheiterten mit der Meldung

“The request signature we calculated does not match the signature you provided. Check your key and signing method.”

Bei den SignedV4-Requests fehlte hingegen der Header

“Missing required header for this request: Content-Md5.”

Das deutet auf eine Konfigurationsabweichung auf Client-Seite hin.

[provokateurin]

Will be fixed by #56366