feature/parity: S3 PostObject does not validate the POST policy signature or reject form fields not covered by policy conditions

[garner007]

Versions

• Fails: localstack/localstack-pro:2026.10.0 (build 2026-10-13, git 738d58ee); also localstack/localstack-pro:2026.10.1 (same result).
• Works: localstack/localstack-pro:2026.09.0.

Config

SERVICES=s3
S3_SKIP_SIGNATURE_VALIDATION=0
S3_VALIDATE_SIGNATURES=1

Inside the container, localstack.pro.core.config.S3_SKIP_SIGNATURE_VALIDATION is False and S3_VALIDATE_SIGNATURES is True.

Expected (AWS, and LocalStack 2026.09.0): a browser-based POST upload (PostObject) must be rejected with 403 when:

1. X-Amz-Signature doesn't match the policy (SignatureDoesNotMatch); or
2. the form contains a field not covered by a policy condition, for example x-amz-meta-foo. AWS: "Each form field … (except x-amz-signature, file, policy, and x-ignore-*) must appear in the list of conditions."

Actual (2026.10.0): both requests return 204 and the object is stored. The other policy checks still work:

• expired policy: 403;
• eq $key / eq $Content-Type mismatch: 403;
• content-length-range: 400 EntityTooLarge.

So only the signature check and the extra-field check appear to be skipped.

Repro (AWS SDK for JavaScript v3, @aws-sdk/s3-presigned-post)

import { S3Client, CreateBucketCommand } from "@aws-sdk/client-s3";
import { createPresignedPost } from "@aws-sdk/s3-presigned-post";

const s3 = new S3Client({
  endpoint: "http://localhost:4566", region: "us-east-1", forcePathStyle: true,
  credentials: { accessKeyId: "test", secretAccessKey: "test" },
});
await s3.send(new CreateBucketCommand({ Bucket: "post-repro" }));
const p = await createPresignedPost(s3, {
  Bucket: "post-repro", Key: "k.pdf", Expires: 300,
  Fields: { "Content-Type": "application/pdf" },
  Conditions: [["eq", "$key", "k.pdf"], ["eq", "$Content-Type", "application/pdf"]],
});
async function post(extra) {
  const f = new FormData();
  for (const [k, v] of Object.entries({ ...p.fields, ...extra })) f.append(k, v);
  f.append("file", new Blob(["%PDF-1.7"], { type: "application/pdf" }), "k.pdf");
  return (await fetch(p.url, { method: "POST", body: f })).status;
}
console.log("valid", await post({}));                                      // 204 (ok)
console.log("bad signature", await post({ "X-Amz-Signature": "0".repeat(64) })); // expected 403, got 204
console.log("unlisted field", await post({ "x-amz-meta-foo": "x" }));      // expected 403, got 204
console.log("wrong type", await post({ "Content-Type": "text/html" }));    // 403 (ok)

Logs (2026.10.0)

AWS s3.PostObject => 204                      # valid
AWS s3.PostObject => 403 (AccessDenied)       # wrong Content-Type / key
AWS s3.PostObject => 204                      # zeroed X-Amz-Signature
AWS s3.PostObject => 204                      # extra x-amz-meta-* field
AWS s3.PostObject => 400 (EntityTooLarge)     # content-length-range
AWS s3.PostObject => 403 (AccessDenied)       # expired policy

Notes

• The 2026.10.0 release notes mention no change to POST policy validation.
• The comment on S3_SKIP_SIGNATURE_VALIDATION in pro/core/config.py says "TODO: rename to be explicitly about pre-signed URL". If the flag was deliberately narrowed to query-string pre-signed URLs, please document how to enable POST policy signature validation now.
• Impact: tests that verify browser-upload policies are enforced pass on AWS but silently stop detecting tampering on LocalStack.

[garner007]

Correction: I said this regressed in 2026.10.0 and worked in 2026.09.0. That was wrong, sorry for the noise. Re-testing localstack-pro:2026.09.0 (digest sha256:801a3dff…, unchanged since 2026-10-02) gives the same result: a POST with a zeroed X-Amz-Signature, and a POST with an extra x-amz-meta-* field not covered by any policy condition, both return 204 and store the object. Our earliest run on 2026.09.0 (2026-10-18) recorded the same thing. It also reproduces on 2026.10.0 and 2026.10.1.

This looks like a long-standing gap rather than a regression. The last open-source validate_post_policy (localstack-core/localstack/services/s3/presigned_url.py) has # TODO: validate the signature and TODO: … if there are fields that are not defined in the policy, we should reject it. S3_SKIP_SIGNATURE_VALIDATION only applies to query-string pre-signed URLs. Expiry, eq/starts-with conditions and content-length-range are enforced correctly.

So this is a parity request:

1. Validate the POST policy signature (SigV4 X-Amz-Signature over the base64 policy, and SigV2 Signature) when S3_SKIP_SIGNATURE_VALIDATION=0, or behind a dedicated flag.
2. Reject form fields not covered by a condition (except x-amz-signature, file, policy and x-ignore-*), as AWS does ("Invalid according to Policy: Extra input fields").

If either is already available behind a setting, a docs pointer would be appreciated. The repro in the original post is unchanged.