Checksums and chunked encoding sent with unauthenticated requests (signature_version=UNSIGNED) - seeking clarification

[andy-js]

Summary

When using signature_version=UNSIGNED (requests with no Authorization header), boto3 v1.36.0+ sends checksums that trigger aws-chunked transfer encoding. This appears inconsistent with AWS documentation and causes failures with S3-compatible services.

Terminology clarification: We're discussing truly unauthenticated requests (no Authorization header), not authenticated requests using X-Amz-Content-SHA256: UNSIGNED-PAYLOAD or STREAMING-UNSIGNED-PAYLOAD-TRAILER.

Current Behavior

from botocore.config import Config
from botocore import UNSIGNED
import boto3

client = boto3.client('s3', config=Config(signature_version=UNSIGNED))
client.put_object(Bucket='bucket', Key='key', Body='foo')

Sends:

• Transfer-Encoding: chunked
• Content-Encoding: aws-chunked
• X-Amz-Decoded-Content-Length: 3
• x-amz-checksum-crc32: <value>
• X-Amz-Content-SHA256: STREAMING-UNSIGNED-PAYLOAD-TRAILER
• No Authorization header

Result: S3-compatible servers return HTTP 411 MissingContentLength.

The disconnect: AWS documentation states chunked uploads require "authenticating requests using the Authorization header" (docs), and checksum headers are part of Signature V4 signing (docs). Yet boto3 sends these for requests with no Authorization header.

Questions

1. Is this intentional? Does AWS S3 accept unauthenticated requests with checksums and chunked encoding? We haven't tested against AWS S3, only S3-compatible services which reject them.

2. Why doesn't request_checksum_calculation: 'when_required' work?

   client = boto3.client(
       's3',
       config=Config(
           signature_version=UNSIGNED,
           s3={'request_checksum_calculation': 'when_required'}
       )
   )
   # Still sends checksums and uses chunked encoding

3. Should boto3 align with the documentation? If AWS docs say these features require authentication, should signature_version=UNSIGNED disable them automatically?

Workaround

Event handler to remove checksums from unauthenticated requests:

client = boto3.client('s3', config=Config(signature_version=UNSIGNED))

def remove_checksum(params, **kwargs):
    if 'checksum' in params.get('context', {}):
        del params['context']['checksum']

client.meta.events.register('before-call', remove_checksum)

Impact

• Tested S3-compatible services reject these requests
• Likely affects other S3-compatible services based on community reports about chunked encoding support
• s3-tests compatibility suite fails
• Uncertain if actual AWS S3 accepts or rejects this pattern

Related

• Announcement: S3 default integrity change #4392 - S3 default integrity change (introduced default checksums in v1.36.0)

---

Environment

• boto3: 1.42.28
• botocore: 1.42.28
• Python: 3.9+