systemClockOffset not applied to events sent over websocket connection

[esauerbo]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

Manually setting the systemClockOffset allows me to successfully establish a websocket connection, but an InvalidSignatureException is returned once events are sent over the connection.

SDK version number

@aws-sdk/[email protected]

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

Chrome 126

Reproduction Steps

Reproduction branch: https://github.com/esauerbo/rekognition-sdk-repro/tree/clockSkew

1. Checkout to the clockSkew branch
2. npm install
3. Get credentials and add to .env
4. npm run dev
5. Set system clock to one hour ahead (without changing time zone)
6. Check network tab for start-face-liveness-session network request. Observe that connection is established successfully but after client sends event, server sends InvalidSignatureException

Observed Behavior

Received error for invalid signature exception

Expected Behavior

systemClockOffset should be applied to events sent over websocket connection.

Possible Solution

This may be relevant, offset doesn't seem to be getting applied.

aws-sdk-js-v3/packages/middleware-websocket/src/get-event-signing-stream.ts

Line 33 in f922dc1

signingDate: now,

Additional Information/Context

No response

[kuhe]

related #5015

[kuhe]

Due to the inability to read the date header in the upgrade response (#6221),

to make use of the fix in #6227, the systemClockOffset must be supplied to the RekognitionStreaming client at initialization.

Example:

import { Rekognition } from '@aws-sdk/client-rekognition';
import { RekognitionStreaming } from '@aws-sdk/client-rekognitionstreaming';

const rekognition = new Rekognition({ ... });

// 1. make a request first, so that the client automatically corrects
// its config.systemClockOffset value if needed.
await rekognition.createFaceLivenessSession({ ... });

// 2. pass that value to the streaming client.
const rekognitionStreaming = new RekognitionStreaming({ 
  systemClockOffset: rekognition.config.systemClockOffset
});

[thaddmt]

@kuhe thanks for the recommendation but I believe that solution will not work for most rekognition consumers as it is recommended that the createFaceLivenessSession call be made in the developers backend where as the streaming client should be called from the customer's device.

I'm guessing in the example you posted above after calling the createFaceLivenessSession API the systemClockOffset value is set if a time difference is detected?

[kuhe]

This was released in https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.605.0.

solution will not work for most rekognition consumers>

They need to know their system clock offset. We've established that the upgrade response headers are not an option.

I'm guessing in the example you posted above after calling the createFaceLivenessSession API the systemClockOffset value is set if a time difference is detected?

Yes.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.