Let’s say you want to let an end user upload a file.

You set up MinIO in a local container in docker/podman-compose, and in another (server-side) container you run a MinIO client. You use that MinIO client to generate a presigned URL. It looks something like https://minio:9000/the/rest/of/the/url. You’re using minio as the domain because this isn’t deployed yet, and you don’t have a public domain to use. Before you pass it back to the end user’s browser, you do a string replacement to localhost:9000 because the browser won’t know what minio:9000 is. In the browser, the client does a PUT request with that URL.

Oh no! It didn’t work! You’re getting this error: The request signature we calculated does not match the signature you provided. Check your key and signing method.

It’s because you replaced the domain. The entire URL is getting hashed, not just the parts that are relevant. And you can’t change the domain in your client, because then your client is trying to connect to the wrong location, and won’t generate the URL.

Why does it do this? Shouldn’t it only hash the arguments? Surely the MinIO server itself will have some way to know if a presigned URL was meant for some other server.