title: More specific rules for an AWS Canonical Request header list?
body: <p>The AWS documentation <a href="http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html" rel="nofollow noreferrer">here</a> seems to have somewhat confusing, incomplete or contradictory information. It states that</p>
  <blockquote>
  <p>CanonicalHeaders is a list of request headers with their values.</p>
  </blockquote>
  <p>Which suggests that we'd put <em>all</em> request headers in the canonical request. However, later, they state</p>
  <blockquote>
  <p>The CanonicalHeaders list must include the following:</p>
  <p>HTTP host header</p>
  <p>If the Content-Type header is present in the request, it must be added to the CanonicalHeaders list.</p>
  <p>Any x-amz-* headers that you plan to include in your request must also be added. For example, if you are using temporary security credentials, you will include x-amz-security-token in your request. You must add this header in the list of CanonicalHeaders.</p>
  </blockquote>
  <p>OK, the bit about the Content-Type and x-amz headers suggests that we don't actually take <em>all</em> headers, because otherwise they wouldn't need to state that they'd be must be included. So then perhaps, we <em>only</em> need to take the <code>Host</code> header, the <code>Content-Type</code> header, and any <code>x-amz-*</code> headers. But then below, it gets more confusing, because here's an example request:</p>
  <pre><code>GET /test.txt HTTP/1.1
  Host: examplebucket.s3.amazonaws.com
  Date: Fri, 24 May 2013 00:00:00 GMT
  Authorization: SignatureToBeCalculated
  Range: bytes=0-9 
  x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  x-amz-date: 20130524T000000Z 
  </code></pre>
  <p>And here's the example canonical request created from it:</p>
  <pre><code>GET
  /test.txt
  
  host:examplebucket.s3.amazonaws.com
  range:bytes=0-9
  x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  x-amz-date:20130524T000000Z
  
  host;range;x-amz-content-sha256;x-amz-date
  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 
  </code></pre>
  <p>But this is inconsistent with both of the interpretations earlier: if we're supposed to only have <code>Content-Type</code>, <code>Host</code> and <code>x-amz-*</code> headers, then what is the <code>range</code> header doing in the list? And if we're just supposed to take all of the headers, then why <em>isn't</em> the <code>Date</code> header in the list?</p>
  <p>Is the list of headers to put in a canonical request then arbitrary, as long as it contains <em>at least</em> the minimum headers? What, exactly, is the definitive set of rules to construct the canonical request headers?</p>