S3 and Inbound TLS: HTTPS-by-Default Enforcement
The S3 gateway turned HTTPS-or-explicit-insecure into the default: no silent plaintext for the gateway or inbound tcp/quic.
Posts
S3 Auth: SigV4, Presigned URLs, and Key Decoupling
Query-string SigV4 for presigned URLs, mandatory X-Amz-Date freshness, and decoupling gateway access/secret keys from the native auth token.
S3 Gateway Core: XML, Buckets, Objects, Lists
The S3 gateway: SigV4, S3-compliant XML errors, Head/List/Copy, pagination, ranges, and metadata — a compatible API surface for real clients.
Client-Held E2EE: Envelope Encryption Real
Envelope encryption with a client-held key: the server stores ciphertext and can’t read it — across S3 and native transports.
Signed Payloads and Server-Sent Events for S3
SigV4 signed payload verification for S3 PUT/POST and Server-Sent Events for async operation notifications.
AWS Chunked Streaming: Signed Payloads Without Buffering
aws-chunked payload encoding streams large S3 uploads in signed chunks — no full-body buffering, per-chunk SigV4 integrity.
Transport Evolution: TCP, QUIC, and the Wire Protocol
Momo’s transport layer grew from TCP to a QUIC/TLS 1.3 fan-out — fixing handshake, ACK framing, deadlines, and TLS identity along the way.
The Sentinel Sweep: An Audit-Driven Security Journey
A 76-deep audit (authed via Sentinel) surfaced CRLF injection, smuggling, traversal and path leaks — the pattern that forged momo’s security mindset.
Pluggable Storage Backends: local, nfs, s3, raw
The [storage] backend seam swaps blob storage (local, nfs, s3, raw) behind one Store interface, keeping CAS metadata local.
External S3 Client Replication Downgrade: When aws-cli Can't Fan Out
External S3 clients like aws-cli don’t send momo headers — the server detects this and downgrades client-side replication modes to server-side alternatives, ensuring replication never silently drops.