Skip to content

fix: skip clock skew calculation for cached responses (Age header) - #3431

Open
toller892 wants to merge 1 commit into
aws:mainfrom
toller892:fix/clock-skew-cached-response
Open

fix: skip clock skew calculation for cached responses (Age header)#3431
toller892 wants to merge 1 commit into
aws:mainfrom
toller892:fix/clock-skew-cached-response

Conversation

@toller892

Copy link
Copy Markdown

Problem

When a response is served from a cache (e.g. CloudFront), the Date header reflects when the original response was generated, not when it is being served. The SDK's RecordResponseTiming middleware uses this Date header to compute clock skew, which produces incorrect results for cached responses.

Once skew is calculated incorrectly, the next AWS call fails with a signature expiration error. The failing response then has a correct Date header, so subsequent calls succeed — but every first call after a cached response fails.

See #3409 for full reproduction steps and raw HTTP traces.

Fix

Check for the standard HTTP Age header in RecordResponseTiming.HandleDeserialize. When present, skip clock skew computation entirely, as the Date header is unreliable for skew calculation on cached responses.

This approach was suggested by @lucix-aws in #3409:

We will likely just specify to check for an Age header and if so disregard any potential skew for that request.

Changes

  • aws/middleware/middleware.go: Add Age header check before computing skew
  • aws/middleware/middleware_test.go: Add test case for cached response with Age header

Fixes #3409

When a response is served from a cache (e.g. CloudFront), the Date header
reflects when the original response was generated, not the current server
time. Using it for clock-skew calculation produces incorrect results that
cause subsequent requests to fail with signature expiration errors.

Check for the standard HTTP Age header and skip skew computation when
present, as suggested by the maintainer in aws#3409.

Fixes aws#3409.
@toller892
toller892 requested a review from a team June 2, 2026 01:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Clock skew calculated incorrectly for cached responses, breaking subsequent API calls

1 participant