Introduction to the problem
Recently I was working on some request signing algorithm and it came out the opinions about including query string in the part that is then signed are "diversified".
Long story short, the argument of the person against including query string in the string for signing is that the query strings can be altered (eg. values can be changed, arguments can be removed/added, order can be changed).
Also I have never ever experienced such behaviour in proxy or load balancer, even though I experienced such things as hiding
Authorization header (eg. by Apache/WSGI), altering method of the request (by load balancer, probably Amazon's servers do such thing). I know such behaviour can be enabled on reverse proxy or load balancer, using some custom scripts / rules, but it could be done with any part of the request.
A lot of work has been done based on the assumption query string should be included, plus it looks silly to not sign one of the most important parts of the request. Thus I need to know if including query string in the raw form (as it is passed within the URL) will be an issue in the future or not.
So my question is:
Is it common for any proxy or load balancer to alter query strings? It seems silly for me. Do you know any proxy or load balancer (software or its installation) that does that by default?
I am sure in such case we can handle signature verification on the level of proxy/load balancer, but it may be a viable argument if this is common among the intermediaries we do not control.
Please, let me know what you know about it. Let me know, if you have any questions.
As a clarification, by query string I mean the "
?arg1=val1&arg2=val2" part of the following URL:
And by "altering the query string" I mean any action that could make it look different for the client and for the server (server sees query string different than the client has used).