PeterPhrak's avatar
PeterPhrak
Frequent Visitor
2 years ago
Status:
Investigating

OAuth and Presigned URLs (S3)

Hi everyone,
 
I'm currently developing a Custom Data Connector (via Power Query SDK) with the PKCE OAuth2 flow.
 
Some of the endpoints that we provide in our connector utilises S3 as a mechanism for asynchronous report generation. Reports of a large result size will issue out a S3 presigned URL.
 
The issue arises as the Connector (Power Query SDK) will always attach an Authorization header containing our access_token on each Web.Contents call. There is no mechanism to remove, omit or to modify this header.
 
This causes an authentication issue when retrieving the dataset from S3, as it does not expect an Authorization header alongside their “X-Amz-*" queries.
 
Is there method to omit the Authorization header from Web.Contents request?
 
Sample error response from AWS.
 
400 Bad Request
x-amz-request-id: WV4PC7TH3ZQ2Z***
x-amz-id-2: AReTb/yPws8sgeAM2FHHioWN5c1eP8aD656Rx9iPqdAHPRIHiGN/W88om5czmmr****
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Wed, 17 Jan 2024 02:08:00 GMT
Server: AmazonS3
Connection: close
 
624
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidArgument</Code><Message>Only one auth mechanism allowed; only the X-Amz-Algorithm query parameter, Signature query string parameter or the Authorization header should be specified</Message><ArgumentName>Authorization</ArgumentName><ArgumentValue>Bearer eyJhbGciOiJSUzI1NiIs***</ArgumentValue><RequestId>WV4PC7TH3ZQ2***</RequestId><HostId>AReTb/yPws8sgeAM2FHHioWN5c1eP8aD656Rx9iPqdAHPR***</HostId></Error>
APIS and Embedding

2 Comments

  • Anonymous's avatar
    Anonymous
    Not applicable
    2 years ago

    Hi PeterPhrak ,

     

    I'm not sure this fits your needs. It is possible to omit the web.content header.

    However, it’s important to note that the Authorization header is often required for authenticated API requests. If you omit it, you may not be able to access the data you need.

    Use the UsernamePassword or Key credential type instead of Anonymous. This allows you to provide the necessary credentials without using the Authorization header.
    If you’re using UsernamePassword, the Username and Password fields can be used to store the information needed to build your URI string.
    In your Web.Contents call, avoid defining headers inline. Instead, consider building your headers separately and then passing them into the Web.Contents function.
    Here’s an example of how you might structure your code:

    let
apiUrl = "https://mysite.azurewebsites.net" & "/api/v1.0/Report/Setter",
options = [Headers=[#\"Content-Type\"=\"application/json\"]], // Define your headers here
result = Json.Document(Web.Contents(apiUrl, options))
in
result

     

    Best regards,
    Community Support Team_ Scott Chang

  • PeterPhrak's avatar
    PeterPhrak
    Frequent Visitor
    2 years ago

    Thanks for your response Anonymous , this won't work in this scenario as we can only utilise the OAuth type at this time. In addition to this, the initial API request to request the data requires the token from the OAuth type.

     

    I understand that the Authorization header is key is required for authenticated requests but having duplicate headers is causing some issues here.

Completed Ideas