fix(sts): return Query API-compatible responses (#5282)

* fix(sts): return Query API-compatible responses * fix(sts): resolve review and CI failures * fix(sts): harden query response conversion * test(e2e): stabilize transition conflict coverage * fix(ilm): retry vanished transition admission CAS * test(e2e): narrow transition overlap coverage --------- Co-authored-by: houseme <housemecn@gmail.com>
2026-08-10 07:06:53 +00:00 · 2026-07-28 10:39:17 +08:00
parent d385cea7c6
commit 5cedab09ab
16 changed files with 982 additions and 209 deletions
@@ -162,13 +162,13 @@ async fn handle_assume_role(

    let session_token = get_session_token(&uri, &headers);
    if session_token.is_some() {
-        return Err(s3_error!(InvalidRequest, "AccessDenied1"));
+        return Err(s3_error!(AccessDenied, "Access Denied"));
    }

    let (cred, owner) = check_key_valid(get_session_token(&uri, &headers).unwrap_or_default(), &user.access_key).await?;

    if cred.is_temp() || cred.is_service_account() {
-        return Err(s3_error!(InvalidRequest, "AccessDenied"));
+        return Err(s3_error!(AccessDenied, "Access Denied"));
    }

    let Ok(iam_store) = crate::admin::runtime_sources::current_ready_iam_handle() else {
@@ -38,6 +38,7 @@ use crate::error::ApiError;
 use crate::license::license_check;
 use crate::server::{
    ADMIN_PREFIX, HEALTH_PREFIX, HEALTH_READY_PATH, MINIO_ADMIN_PREFIX, PROFILE_CPU_PATH, PROFILE_MEMORY_PATH, is_admin_path,
+    is_sts_query_request,
 };
 use crate::storage::storage_api::lock_bucket_targets_metadata;
 use aws_sdk_s3::primitives::ByteStream as AwsByteStream;
@@ -2769,15 +2770,7 @@ where
        }

        // AssumeRole
-        if method == Method::POST
-            && path == "/"
-            && headers
-                .get(header::CONTENT_TYPE)
-                .and_then(|v| v.to_str().ok())
-                .map(|ct| ct.split(';').next().unwrap_or("").trim().to_lowercase())
-                .map(|ct| ct == "application/x-www-form-urlencoded")
-                .unwrap_or(false)
-        {
+        if is_sts_query_request(method, uri, headers) {
            return true;
        }

@@ -2827,22 +2820,7 @@ where
        // The handler dispatches on the Action parameter: AssumeRole will reject if
        // credentials are missing, AssumeRoleWithWebIdentity will validate the JWT.
        // Require application/x-www-form-urlencoded Content-Type to narrow the bypass.
-        if req.method == Method::POST
-            && path == "/"
-            && req.credentials.is_none()
-            && req
-                .headers
-                .get(header::CONTENT_TYPE)
-                .and_then(|v| v.to_str().ok())
-                .map(|ct| {
-                    ct.split(';')
-                        .next()
-                        .unwrap_or("")
-                        .trim()
-                        .eq_ignore_ascii_case("application/x-www-form-urlencoded")
-                })
-                .unwrap_or(false)
-        {
+        if req.credentials.is_none() && is_sts_query_request(&req.method, &req.uri, &req.headers) {
            return Ok(());
        }

@@ -4794,6 +4772,43 @@ mod tests {
        assert_eq!(err.code(), &S3ErrorCode::AccessDenied);
    }

+    #[tokio::test]
+    async fn check_access_limits_anonymous_sts_exemption_to_form_content_type() {
+        let router: S3Router<AdminOperation> = S3Router::new(false);
+        let request = |content_type: Option<&'static str>| {
+            let mut headers = HeaderMap::new();
+            if let Some(content_type) = content_type {
+                headers.insert(http::header::CONTENT_TYPE, HeaderValue::from_static(content_type));
+            }
+            S3Request {
+                input: Body::from(String::from("Action=AssumeRoleWithWebIdentity")),
+                method: Method::POST,
+                uri: Uri::from_static("/"),
+                headers,
+                extensions: http::Extensions::new(),
+                credentials: None,
+                region: None,
+                service: None,
+                trailing_headers: None,
+            }
+        };
+
+        for content_type in [None, Some("application/json")] {
+            let mut req = request(content_type);
+            let err = router
+                .check_access(&mut req)
+                .await
+                .expect_err("anonymous STS request without form content type must be denied");
+            assert_eq!(err.code(), &S3ErrorCode::AccessDenied);
+        }
+
+        let mut req = request(Some("application/x-www-form-urlencoded"));
+        router
+            .check_access(&mut req)
+            .await
+            .expect("anonymous form-encoded STS request should reach identity validation");
+    }
+
    #[tokio::test]
    async fn check_access_allows_object_zip_download_token_navigation() {
        let router: S3Router<AdminOperation> = S3Router::new(false);
@@ -407,6 +407,8 @@ pub(crate) enum PathCategory {
    InternodeRpc,
    /// Health/probe paths — skip compression (tiny responses)
    Probe,
+    /// STS Query API — response compatibility is applied outside compression.
+    StsQueryApi,
 }

 impl PathCategory {
@@ -544,7 +546,14 @@ where
    }

    fn call(&mut self, req: Request<ReqBody>) -> Self::Future {
-        let category = PathCategory::classify(req.uri().path());
+        let category = if req.method() == http::Method::POST
+            && req.uri().path() == "/"
+            && req.extensions().get::<crate::server::layer::StsQueryRequest>().is_some()
+        {
+            PathCategory::StsQueryApi
+        } else {
+            PathCategory::classify(req.uri().path())
+        };
        InjectCategoryFut {
            inner: self.inner.call(req),
            category,
@@ -785,5 +794,6 @@ mod tests {
        assert!(!PathCategory::Console.should_evaluate_compression());
        assert!(!PathCategory::InternodeRpc.should_evaluate_compression());
        assert!(!PathCategory::Probe.should_evaluate_compression());
+        assert!(!PathCategory::StsQueryApi.should_evaluate_compression());
    }
 }
@@ -24,8 +24,8 @@ use crate::server::{
    layer::{
        BodylessStatusFixLayer, ConditionalCorsLayer, DoubleSlashListBucketsCompatLayer, EmptyBodyContentLengthCompatLayer,
        HeadRequestBodyFixLayer, IcebergRestErrorCompatLayer, ObjectAttributesEtagFixLayer, PublicHealthEndpointLayer,
-        RedirectLayer, RequestContextLayer, RequestLoggingLayer, S3ErrorMessageCompatLayer, VirtualHostStyleHintLayer,
-        redact_sensitive_uri_query,
+        RedirectLayer, RequestContextLayer, RequestLoggingLayer, S3ErrorMessageCompatLayer, StsQueryApiCompatLayer,
+        VirtualHostStyleHintLayer, redact_sensitive_uri_query,
    },
    rate_limit::{RateLimitLayer, api_rate_limit_layer_from_env},
    tls_material::{
@@ -1390,26 +1390,27 @@ fn process_connection(
        //  3. TrustedProxyLayer                       — conditional, parses X-Forwarded-For
        //  4. SetRequestIdLayer                       — generates X-Request-ID
        //  5. RequestContextLayer                    — creates RequestContext in extensions
-        //  6. EmptyBodyContentLengthCompatLayer       — adds Content-Length: 0 for known empty-body API routes
-        //  7. CatchPanicLayer                        — panic → 500
-        //  8. RateLimitLayer                         — conditional (external stack only), per-client 429 throttling
-        //  9. ReadinessGateLayer                     — blocks until ready
-        // 10. KeystoneAuthLayer                      — X-Auth-Token validation
-        // 11. TraceLayer                             — request span creation + metrics
-        // 12. RequestLoggingLayer                    — single completion event per request
-        // 13. PropagateRequestIdLayer                — X-Request-ID → response
-        // 14. CompressionLayer                       — response compression (whitelist, path-aware)
-        // 15. PathCategoryInjectionLayer             — injects path category for compression predicate
-        // 16. S3ErrorMessageCompatLayer              — missing S3 error message compatibility
-        // 17. IcebergRestErrorCompatLayer            — Iceberg REST JSON error compatibility
-        // 18. ObjectAttributesEtagFixLayer           — ETag fix for GetObjectAttributes
-        // 19. ConditionalCorsLayer                   — S3 API CORS
-        // 20. RedirectLayer                          — console redirect (conditional)
-        // 21. BodylessStatusFixLayer                 — clears body for 1xx/204/205/304 responses
-        // 22. HeadRequestBodyFixLayer                — strips actual body bytes from HEAD responses
-        // 23. PublicHealthEndpointLayer              — handles public health before s3s host parsing
-        // 24. VirtualHostStyleHintLayer              — actionable error for unroutable virtual-hosted-style (conditional)
-        // 25. DoubleSlashListBucketsCompatLayer      — rewrites `GET //` to `GET /` for ListBuckets (MinIO browser compat)
+        //  6. StsQueryApiCompatLayer                 — route-scoped STS envelopes, including outer short-circuit errors
+        //  7. EmptyBodyContentLengthCompatLayer       — adds Content-Length: 0 for known empty-body API routes
+        //  8. CatchPanicLayer                        — panic → 500
+        //  9. RateLimitLayer                         — conditional (external stack only), per-client 429 throttling
+        // 10. ReadinessGateLayer                     — blocks until ready
+        // 11. KeystoneAuthLayer                      — X-Auth-Token validation
+        // 12. TraceLayer                             — request span creation + metrics
+        // 13. RequestLoggingLayer                    — single completion event per request
+        // 14. PropagateRequestIdLayer                — X-Request-ID → response
+        // 15. CompressionLayer                       — response compression (whitelist, path-aware)
+        // 16. PathCategoryInjectionLayer             — injects path category for compression predicate
+        // 17. S3ErrorMessageCompatLayer              — missing S3 error message compatibility
+        // 18. IcebergRestErrorCompatLayer            — Iceberg REST JSON error compatibility
+        // 19. ObjectAttributesEtagFixLayer           — ETag fix for GetObjectAttributes
+        // 20. ConditionalCorsLayer                   — S3 API CORS
+        // 21. RedirectLayer                          — console redirect (conditional)
+        // 22. BodylessStatusFixLayer                 — clears body for 1xx/204/205/304 responses
+        // 23. HeadRequestBodyFixLayer                — strips actual body bytes from HEAD responses
+        // 24. PublicHealthEndpointLayer              — handles public health before s3s host parsing
+        // 25. VirtualHostStyleHintLayer              — actionable error for unroutable virtual-hosted-style (conditional)
+        // 26. DoubleSlashListBucketsCompatLayer      — rewrites `GET //` to `GET /` for ListBuckets (MinIO browser compat)
        // ─────────────────────────────────────────────────────────────
        // Batch 1 intentionally keeps the external and internode stacks behaviorally
        // identical while giving each path family a named construction boundary.
@@ -1431,6 +1432,7 @@ fn process_connection(
                .option_layer(trusted_proxy_layer.clone())
                .layer(SetRequestIdLayer::x_request_id(MakeRequestUuid))
                .layer(InternodeRequestContextLiteLayer)
+                .layer(StsQueryApiCompatLayer)
                .layer(EmptyBodyContentLengthCompatLayer)
                .layer(CatchPanicLayer::new())
                // Per-client API rate limit (backlog#1191): rejects over-limit
@@ -28,16 +28,19 @@ use crate::storage_api::server::layer::apply_cors_headers;
 use crate::storage_api::server::layer::request_context::{
    RequestContext, extract_request_id_from_headers, extract_trace_context_ids_from_headers, spawn_traced,
 };
-use bytes::Bytes;
+use bytes::{Bytes, BytesMut};
+use futures::future::Either;
 use http::{HeaderMap, HeaderValue, Method, Request as HttpRequest, Response, StatusCode, Uri};
 use http_body::Body;
-use http_body_util::BodyExt;
+use http_body_util::{BodyExt, Full};
 use hyper::body::Incoming;
+use quick_xml::events::Event;
 use rustfs_trusted_proxies::ClientInfo;
 use rustfs_utils::get_env_opt_str;
 use rustfs_utils::http::headers::AMZ_REQUEST_ID;
 use s3s::S3ErrorCode;
 use serde::{Deserialize, Serialize};
+use std::borrow::Cow;
 use std::future::Future;
 use std::pin::Pin;
 use std::sync::Arc;
@@ -56,6 +59,9 @@ const LOG_SUBSYSTEM_HTTP: &str = "http";
 const REDACTED_QUERY_VALUE: &str = "redacted";
 const OBJECT_ZIP_DOWNLOADS_PATH: &str = "/v3/object-zip-downloads/";
 const HTTP_REQUEST_INFLIGHT_WARN_THRESHOLD: Duration = Duration::from_secs(5);
+const STS_RESPONSE_METADATA_TAG: &str = "ResponseMetadata";
+const STS_REQUEST_ID_TAG: &str = "RequestId";
+const STS_SUCCESS_RESPONSE_TAGS: [&str; 2] = ["AssumeRoleResponse", "AssumeRoleWithWebIdentityResponse"];

 pub(crate) fn redact_sensitive_uri_query(uri: &http::Uri) -> String {
    let path = uri.path();
@@ -601,12 +607,14 @@ where
    }

    fn call(&mut self, req: HttpRequest<Incoming>) -> Self::Future {
+        let is_sts_query =
+            req.method() == Method::POST && req.uri().path() == "/" && req.extensions().get::<StsQueryRequest>().is_some();
        let mut inner = self.inner.clone();

        Box::pin(async move {
            let response = inner.call(req).await?;
            let (parts, body) = response.into_parts();
-            let should_fix = parts.status == StatusCode::FORBIDDEN && is_xml_response(&parts.headers);
+            let should_fix = !is_sts_query && parts.status == StatusCode::FORBIDDEN && is_xml_response(&parts.headers);

            let response = match body {
                HybridBody::Rest { rest_body } => {
@@ -629,6 +637,81 @@ where
    }
 }

+#[derive(Clone)]
+pub struct StsQueryApiCompatLayer;
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct StsQueryRequest;
+
+pub(crate) fn is_sts_query_request(method: &Method, uri: &Uri, headers: &HeaderMap) -> bool {
+    method == Method::POST
+        && uri.path() == "/"
+        && headers
+            .get(http::header::CONTENT_TYPE)
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| value.split(';').next())
+            .is_some_and(|value| value.trim().eq_ignore_ascii_case("application/x-www-form-urlencoded"))
+}
+
+impl<S> Layer<S> for StsQueryApiCompatLayer {
+    type Service = StsQueryApiCompatService<S>;
+
+    fn layer(&self, inner: S) -> Self::Service {
+        StsQueryApiCompatService { inner }
+    }
+}
+
+#[derive(Clone)]
+pub struct StsQueryApiCompatService<S> {
+    inner: S,
+}
+
+type StsBoxError = Box<dyn std::error::Error + Send + Sync>;
+type StsBoxBody = tower_http::body::UnsyncBoxBody<Bytes, StsBoxError>;
+
+impl<S, RequestBody> Service<HttpRequest<RequestBody>> for StsQueryApiCompatService<S>
+where
+    S: Service<HttpRequest<RequestBody>, Response = Response<StsBoxBody>> + Send + 'static,
+    S::Future: Send + 'static,
+    S::Error: From<StsBoxError> + Send + 'static,
+{
+    type Response = Response<StsBoxBody>;
+    type Error = S::Error;
+    type Future = Either<S::Future, Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>>;
+
+    fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        self.inner.poll_ready(cx)
+    }
+
+    fn call(&mut self, mut req: HttpRequest<RequestBody>) -> Self::Future {
+        if !is_sts_query_request(req.method(), req.uri(), req.headers()) {
+            return Either::Left(self.inner.call(req));
+        }
+
+        req.extensions_mut().insert(StsQueryRequest);
+        let (request_id, request_id_header) = sts_response_request_id(&req);
+        let future = self.inner.call(req);
+
+        Either::Right(Box::pin(async move {
+            let response = future.await?;
+            let (mut parts, body) = response.into_parts();
+            parts.headers.insert(AMZ_REQUEST_ID, request_id_header);
+
+            let (body, changed) = convert_sts_query_response(body, parts.status, &request_id).await?;
+            if changed {
+                parts.headers.remove(http::header::CONTENT_LENGTH);
+                parts
+                    .headers
+                    .insert(http::header::CONTENT_TYPE, HeaderValue::from_static("application/xml"));
+            }
+            let body = tower_http::body::UnsyncBoxBody::new(Full::from(body).map_err(|error| -> StsBoxError { match error {} }));
+            let response = Response::from_parts(parts, body);
+
+            Ok(response)
+        }))
+    }
+}
+
 #[derive(Clone)]
 pub struct IcebergRestErrorCompatLayer;

@@ -1338,6 +1421,153 @@ fn is_xml_response(headers: &HeaderMap) -> bool {
    }
 }

+fn sts_response_request_id<B>(req: &HttpRequest<B>) -> (String, HeaderValue) {
+    let request_id = req
+        .extensions()
+        .get::<RequestContext>()
+        .map(|context| context.request_id.as_str())
+        .filter(|request_id| !request_id.trim().is_empty())
+        .unwrap_or("sts-request-id")
+        .to_owned();
+
+    match HeaderValue::from_str(&request_id) {
+        Ok(header) => (request_id, header),
+        Err(_) => ("sts-request-id".to_owned(), HeaderValue::from_static("sts-request-id")),
+    }
+}
+
+async fn convert_sts_query_response<RestBody>(
+    body: RestBody,
+    status: StatusCode,
+    request_id: &str,
+) -> Result<(Bytes, bool), RestBody::Error>
+where
+    RestBody: Body<Data = Bytes>,
+{
+    let bytes = BodyExt::collect(body).await?.to_bytes();
+    let Ok(xml) = std::str::from_utf8(&bytes) else {
+        return Ok((bytes, false));
+    };
+
+    let converted = if status.is_success() {
+        add_sts_response_metadata(xml, request_id)
+    } else {
+        Some(Bytes::from(wrap_sts_error_response(xml, status, request_id)))
+    };
+
+    match converted {
+        Some(xml) => Ok((xml, true)),
+        None => Ok((bytes, false)),
+    }
+}
+
+fn add_sts_response_metadata(xml: &str, request_id: &str) -> Option<Bytes> {
+    let mut reader = quick_xml::Reader::from_str(xml);
+    let mut depth = 0_usize;
+    let mut root_prefix = None;
+
+    loop {
+        let event_start = usize::try_from(reader.buffer_position()).ok()?;
+        match reader.read_event() {
+            Ok(Event::Start(element)) => {
+                if depth == 0 {
+                    if !is_sts_success_response_tag(element.local_name().as_ref()) {
+                        return None;
+                    }
+                    root_prefix = element
+                        .name()
+                        .prefix()
+                        .map(|prefix| std::str::from_utf8(prefix.as_ref()).map(str::to_owned))
+                        .transpose()
+                        .ok()?;
+                } else if depth == 1 && element.local_name().as_ref() == STS_RESPONSE_METADATA_TAG.as_bytes() {
+                    return None;
+                }
+                depth += 1;
+            }
+            Ok(Event::Empty(element)) => {
+                if depth == 0 {
+                    return None;
+                }
+                if depth == 1 && element.local_name().as_ref() == STS_RESPONSE_METADATA_TAG.as_bytes() {
+                    return None;
+                }
+            }
+            Ok(Event::End(element)) => {
+                if depth == 0 {
+                    return None;
+                }
+                if depth == 1 {
+                    if !is_sts_success_response_tag(element.local_name().as_ref()) {
+                        return None;
+                    }
+                    let prefix = root_prefix.as_deref().map(|prefix| format!("{prefix}:")).unwrap_or_default();
+                    let metadata = format!(
+                        "<{prefix}{STS_RESPONSE_METADATA_TAG}>\
+                         <{prefix}{STS_REQUEST_ID_TAG}>{request_id}</{prefix}{STS_REQUEST_ID_TAG}>\
+                         </{prefix}{STS_RESPONSE_METADATA_TAG}>",
+                        request_id = xml_escape(request_id),
+                    );
+                    let capacity = xml.len().checked_add(metadata.len())?;
+                    let mut converted = BytesMut::with_capacity(capacity);
+                    converted.extend_from_slice(&xml.as_bytes()[..event_start]);
+                    converted.extend_from_slice(metadata.as_bytes());
+                    converted.extend_from_slice(&xml.as_bytes()[event_start..]);
+                    return Some(converted.freeze());
+                }
+                depth -= 1;
+            }
+            Ok(Event::Eof) | Err(_) => return None,
+            _ => {}
+        }
+    }
+}
+
+fn is_sts_success_response_tag(tag: &[u8]) -> bool {
+    STS_SUCCESS_RESPONSE_TAGS.iter().any(|candidate| candidate.as_bytes() == tag)
+}
+
+fn wrap_sts_error_response(xml: &str, status: StatusCode, request_id: &str) -> String {
+    let parsed = quick_xml::de::from_str::<SerializedS3Error>(xml).ok();
+    let (code, message) = parsed
+        .as_ref()
+        .map(|error| {
+            let message = match error.message.as_deref() {
+                Some(message) => Cow::Borrowed(message),
+                None if error.code == S3ErrorCode::SignatureDoesNotMatch.as_str() => {
+                    Cow::Owned(ApiError::error_code_to_message(&S3ErrorCode::SignatureDoesNotMatch))
+                }
+                None => Cow::Borrowed(error.code.as_str()),
+            };
+            (error.code.as_str(), message)
+        })
+        .unwrap_or_else(|| {
+            let (code, message) = sts_error_for_status(status);
+            (code, Cow::Borrowed(message))
+        });
+    let error_type = if status.is_server_error() { "Receiver" } else { "Sender" };
+
+    format!(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+         <ErrorResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\
+        <Error><Type>{error_type}</Type><Code>{code}</Code><Message>{message}</Message></Error>\
+         <RequestId>{request_id}</RequestId></ErrorResponse>",
+        code = xml_escape(code),
+        message = xml_escape(&message),
+        request_id = xml_escape(request_id),
+    )
+}
+
+fn sts_error_for_status(status: StatusCode) -> (&'static str, &'static str) {
+    match status {
+        StatusCode::BAD_REQUEST => ("InvalidRequest", "Invalid Request"),
+        StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN => ("AccessDenied", "Access Denied"),
+        StatusCode::TOO_MANY_REQUESTS => ("TooManyRequests", "Request rate limit exceeded"),
+        StatusCode::SERVICE_UNAVAILABLE => ("ServiceUnavailable", "Service Unavailable"),
+        _ => ("InternalError", "Internal Server Error"),
+    }
+}
+
 async fn fix_object_attributes_etag_in_xml<RestBody>(body: RestBody) -> Result<RestBody, RestBody::Error>
 where
    RestBody: Body<Data = Bytes> + From<Bytes>,
@@ -1780,6 +2010,7 @@ fn rewrite_double_slash_root(uri: &Uri) -> Option<Uri> {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::server::compress::{HttpCompressionConfig, PathAwareHttpCompressionPredicate, PathCategoryInjectionLayer};
    use crate::server::{FAVICON_PATH, LICENSE, RemoteAddr, VERSION};
    use futures::future::{Ready, ready};
    use http::Request;
@@ -2884,6 +3115,331 @@ mod tests {
        assert_eq!(bytes, input);
    }

+    #[derive(Clone)]
+    struct FixedStsResponse {
+        status: StatusCode,
+        body: Bytes,
+        upstream_request_id: Option<&'static str>,
+    }
+
+    impl<RequestBody: Send + 'static> Service<Request<RequestBody>> for FixedStsResponse {
+        type Response = Response<StsBoxBody>;
+        type Error = StsBoxError;
+        type Future = Ready<Result<Self::Response, Self::Error>>;
+
+        fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+            Poll::Ready(Ok(()))
+        }
+
+        fn call(&mut self, _req: Request<RequestBody>) -> Self::Future {
+            let body = tower_http::body::UnsyncBoxBody::new(
+                Full::from(self.body.clone()).map_err(|error| -> StsBoxError { match error {} }),
+            );
+            let mut response = Response::builder()
+                .status(self.status)
+                .header(http::header::CONTENT_TYPE, "application/xml")
+                .header(http::header::CONTENT_LENGTH, self.body.len());
+            if let Some(request_id) = self.upstream_request_id {
+                response = response.header(AMZ_REQUEST_ID, request_id);
+            }
+            ready(Ok(response.body(body).expect("fixed STS response")))
+        }
+    }
+
+    async fn call_sts_compat_layer(
+        status: StatusCode,
+        body: &'static [u8],
+        upstream_request_id: Option<&'static str>,
+    ) -> (HeaderMap, String) {
+        let mut service = StsQueryApiCompatLayer.layer(FixedStsResponse {
+            status,
+            body: Bytes::from_static(body),
+            upstream_request_id,
+        });
+        let mut request = Request::builder()
+            .method(Method::POST)
+            .uri("/")
+            .header(http::header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+            .body(())
+            .expect("STS request");
+        request.extensions_mut().insert(RequestContext {
+            request_id: "server-request-id".to_string(),
+            x_amz_request_id: "untrusted-upstream-id".to_string(),
+            trace_id: None,
+            span_id: None,
+            start_time: Instant::now(),
+        });
+
+        let response = service.call(request).await.expect("STS compatibility response");
+        let headers = response.headers().clone();
+        let body = BodyExt::collect(response.into_body())
+            .await
+            .expect("collect STS response")
+            .to_bytes();
+        (headers, String::from_utf8(body.to_vec()).expect("STS response should be UTF-8 XML"))
+    }
+
+    #[tokio::test]
+    async fn sts_compat_layer_uses_canonical_request_id_for_success_header_and_xml() {
+        let (headers, body) = call_sts_compat_layer(
+            StatusCode::OK,
+            b"<AssumeRoleResponse><AssumeRoleResult/></AssumeRoleResponse>",
+            Some("upstream-request-id"),
+        )
+        .await;
+
+        assert_eq!(
+            headers.get(AMZ_REQUEST_ID).and_then(|value| value.to_str().ok()),
+            Some("server-request-id")
+        );
+        assert!(!headers.contains_key(http::header::CONTENT_LENGTH));
+        assert!(body.contains("<ResponseMetadata><RequestId>server-request-id</RequestId></ResponseMetadata>"));
+        assert!(!body.contains("untrusted-upstream-id"));
+    }
+
+    #[tokio::test]
+    async fn sts_compat_layer_uses_same_request_id_for_error_header_and_xml() {
+        let (headers, body) = call_sts_compat_layer(
+            StatusCode::FORBIDDEN,
+            b"<Error><Code>AccessDenied</Code><Message>Access Denied</Message></Error>",
+            None,
+        )
+        .await;
+
+        assert_eq!(
+            headers.get(AMZ_REQUEST_ID).and_then(|value| value.to_str().ok()),
+            Some("server-request-id")
+        );
+        assert!(body.contains("<ErrorResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">"));
+        assert!(body.contains("<RequestId>server-request-id</RequestId>"));
+    }
+
+    #[test]
+    fn sts_response_request_id_rejects_empty_context_id() {
+        let mut request = Request::new(());
+        request.extensions_mut().insert(RequestContext {
+            request_id: String::new(),
+            x_amz_request_id: String::new(),
+            trace_id: None,
+            span_id: None,
+            start_time: Instant::now(),
+        });
+
+        let (request_id, header) = sts_response_request_id(&request);
+        assert_eq!(request_id, "sts-request-id");
+        assert_eq!(header, HeaderValue::from_static("sts-request-id"));
+    }
+
+    #[test]
+    fn sts_query_route_match_requires_post_root_and_form_content_type() {
+        let uri = Uri::from_static("/");
+        let mut headers = HeaderMap::new();
+
+        assert!(!is_sts_query_request(&Method::POST, &uri, &headers));
+
+        headers.insert(http::header::CONTENT_TYPE, HeaderValue::from_static("application/json"));
+        assert!(!is_sts_query_request(&Method::POST, &uri, &headers));
+
+        headers.insert(
+            http::header::CONTENT_TYPE,
+            HeaderValue::from_static("application/x-www-form-urlencoded; charset=utf-8"),
+        );
+        assert!(is_sts_query_request(&Method::POST, &uri, &headers));
+        assert!(!is_sts_query_request(&Method::GET, &uri, &headers));
+        assert!(!is_sts_query_request(&Method::POST, &Uri::from_static("/bucket"), &headers));
+    }
+
+    #[test]
+    fn sts_success_response_gets_response_metadata() {
+        let xml = "<AssumeRoleResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\
+             <AssumeRoleResult><Credentials/></AssumeRoleResult></AssumeRoleResponse>";
+        let converted = add_sts_response_metadata(xml, "request-123").expect("AssumeRole response should be converted");
+        let converted = std::str::from_utf8(&converted).expect("converted response should be UTF-8 XML");
+
+        assert!(converted.contains("<Credentials/>"));
+        assert!(converted.contains("<ResponseMetadata><RequestId>request-123</RequestId></ResponseMetadata>"));
+        assert!(converted.ends_with("</AssumeRoleResponse>"));
+    }
+
+    #[test]
+    fn sts_web_identity_success_response_gets_response_metadata() {
+        let xml = "<AssumeRoleWithWebIdentityResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\
+             <AssumeRoleWithWebIdentityResult><Credentials/></AssumeRoleWithWebIdentityResult>\
+             </AssumeRoleWithWebIdentityResponse>";
+        let converted =
+            add_sts_response_metadata(xml, "request-123").expect("AssumeRoleWithWebIdentity response should be converted");
+        let converted = std::str::from_utf8(&converted).expect("converted response should be UTF-8 XML");
+
+        assert!(converted.contains("<Credentials/>"));
+        assert!(converted.contains("<ResponseMetadata><RequestId>request-123</RequestId></ResponseMetadata>"));
+        assert!(converted.ends_with("</AssumeRoleWithWebIdentityResponse>"));
+    }
+
+    #[test]
+    fn sts_namespaced_success_response_gets_namespaced_metadata() {
+        let xml = "<sts:AssumeRoleResponse xmlns:sts=\"https://sts.amazonaws.com/doc/2011-06-15/\">\
+                   <sts:AssumeRoleResult/></sts:AssumeRoleResponse>";
+        let converted = add_sts_response_metadata(xml, "request-123").expect("namespaced response should be converted");
+        let converted = std::str::from_utf8(&converted).expect("converted response should be UTF-8 XML");
+
+        assert!(converted.contains("<sts:ResponseMetadata><sts:RequestId>request-123</sts:RequestId></sts:ResponseMetadata>"));
+        assert!(converted.ends_with("</sts:AssumeRoleResponse>"));
+    }
+
+    #[test]
+    fn sts_success_response_with_existing_metadata_is_unchanged() {
+        let xml = "<AssumeRoleResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\
+                   <AssumeRoleResult/>\
+                   <ResponseMetadata source=\"upstream\"><RequestId>existing</RequestId></ResponseMetadata>\
+                   </AssumeRoleResponse>";
+
+        assert!(add_sts_response_metadata(xml, "request-123").is_none());
+    }
+
+    #[test]
+    fn sts_error_response_uses_query_api_envelope() {
+        let converted = wrap_sts_error_response(
+            "<Error><Code>AccessDenied</Code><Message>Access &amp; Denied</Message></Error>",
+            StatusCode::FORBIDDEN,
+            "request-456",
+        );
+
+        assert!(converted.contains("<ErrorResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">"));
+        assert!(converted.contains("<Type>Sender</Type>"));
+        assert!(converted.contains("<Code>AccessDenied</Code>"));
+        assert!(converted.contains("<Message>Access &amp; Denied</Message>"));
+        assert!(converted.contains("<RequestId>request-456</RequestId>"));
+    }
+
+    #[test]
+    fn sts_signature_error_response_fills_missing_message() {
+        let converted =
+            wrap_sts_error_response("<Error><Code>SignatureDoesNotMatch</Code></Error>", StatusCode::FORBIDDEN, "request-456");
+        let expected = ApiError::error_code_to_message(&S3ErrorCode::SignatureDoesNotMatch);
+
+        assert!(converted.contains(&format!("<Message>{expected}</Message>")));
+    }
+
+    #[tokio::test]
+    async fn sts_compat_layer_wraps_non_xml_short_circuit_errors() {
+        let (headers, body) =
+            call_sts_compat_layer(StatusCode::SERVICE_UNAVAILABLE, b"Service not ready: waiting for iam", None).await;
+
+        assert_eq!(
+            headers.get(AMZ_REQUEST_ID).and_then(|value| value.to_str().ok()),
+            Some("server-request-id")
+        );
+        assert!(body.contains("<Type>Receiver</Type>"));
+        assert!(body.contains("<Code>ServiceUnavailable</Code>"));
+        assert!(body.contains("<Message>Service Unavailable</Message>"));
+        assert!(body.contains("<RequestId>server-request-id</RequestId>"));
+        assert!(!body.contains("waiting for iam"));
+    }
+
+    #[tokio::test]
+    async fn sts_compat_layer_replaces_upstream_and_duplicate_error_request_ids() {
+        let (headers, body) = call_sts_compat_layer(
+            StatusCode::FORBIDDEN,
+            b"<Error><Code>AccessDenied</Code><Message>Access Denied</Message>\
+              <RequestId>body-request-id-1</RequestId><RequestId>body-request-id-2</RequestId></Error>",
+            Some("header-request-id"),
+        )
+        .await;
+
+        assert_eq!(
+            headers.get(AMZ_REQUEST_ID).and_then(|value| value.to_str().ok()),
+            Some("server-request-id")
+        );
+        assert_eq!(body.matches("<RequestId>").count(), 1);
+        assert!(body.contains("<RequestId>server-request-id</RequestId>"));
+        for stale_request_id in ["header-request-id", "body-request-id-1", "body-request-id-2"] {
+            assert!(!body.contains(stale_request_id));
+        }
+    }
+
+    #[tokio::test]
+    async fn sts_compat_layer_falls_back_for_empty_and_malformed_error_xml() {
+        for (body, status, expected_code, expected_message) in [
+            (
+                b"".as_slice(),
+                StatusCode::SERVICE_UNAVAILABLE,
+                "ServiceUnavailable",
+                "Service Unavailable",
+            ),
+            (
+                b"<Error><Code>AccessDenied".as_slice(),
+                StatusCode::BAD_GATEWAY,
+                "InternalError",
+                "Internal Server Error",
+            ),
+        ] {
+            let (headers, body) = call_sts_compat_layer(status, body, None).await;
+
+            assert_eq!(
+                headers.get(AMZ_REQUEST_ID).and_then(|value| value.to_str().ok()),
+                Some("server-request-id")
+            );
+            assert!(body.contains("<Type>Receiver</Type>"));
+            assert!(body.contains(&format!("<Code>{expected_code}</Code>")));
+            assert!(body.contains(&format!("<Message>{expected_message}</Message>")));
+            assert_eq!(body.matches("<RequestId>").count(), 1);
+            assert!(body.contains("<RequestId>server-request-id</RequestId>"));
+        }
+    }
+
+    #[tokio::test]
+    async fn sts_compat_layer_prevents_pre_conversion_compression() {
+        let xml = format!(
+            "<AssumeRoleResponse><AssumeRoleResult>{}</AssumeRoleResult></AssumeRoleResponse>",
+            "x".repeat(2048)
+        );
+        let mut service = tower::ServiceBuilder::new()
+            .layer(StsQueryApiCompatLayer)
+            .layer(tower_http::catch_panic::CatchPanicLayer::new())
+            .layer(
+                tower_http::compression::CompressionLayer::new().compress_when(PathAwareHttpCompressionPredicate::new(
+                    HttpCompressionConfig {
+                        enabled: true,
+                        extensions: Vec::new(),
+                        mime_patterns: vec!["application/xml".to_owned()],
+                        min_size: 0,
+                    },
+                )),
+            )
+            .layer(PathCategoryInjectionLayer)
+            .service(FixedStsResponse {
+                status: StatusCode::OK,
+                body: Bytes::from(xml),
+                upstream_request_id: None,
+            });
+        let mut request = Request::builder()
+            .method(Method::POST)
+            .uri("/")
+            .header(http::header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+            .header(http::header::ACCEPT_ENCODING, "gzip")
+            .body(())
+            .expect("STS request");
+        request.extensions_mut().insert(RequestContext {
+            request_id: "server-request-id".to_string(),
+            x_amz_request_id: String::new(),
+            trace_id: None,
+            span_id: None,
+            start_time: Instant::now(),
+        });
+
+        let response = service.call(request).await.expect("STS compatibility response");
+        assert!(
+            !response.headers().contains_key(http::header::CONTENT_ENCODING),
+            "STS XML must stay uncompressed until the compatibility envelope is complete"
+        );
+        let body = BodyExt::collect(response.into_body())
+            .await
+            .expect("collect STS response")
+            .to_bytes();
+        let body = String::from_utf8(body.to_vec()).expect("STS response should be UTF-8 XML");
+        assert!(body.contains("<ResponseMetadata><RequestId>server-request-id</RequestId></ResponseMetadata>"));
+    }
+
    #[tokio::test]
    async fn iceberg_rest_error_conversion_returns_standard_json_envelope() {
        let body = Full::from(Bytes::from_static(
@@ -58,7 +58,7 @@ pub(crate) use health::{
 pub(crate) use health::{HealthProbe, build_health_response_parts, collect_probe_readiness, probe_from_path};
 pub(crate) use http::HeaderMapCarrier;
 pub(crate) use http::active_http_requests;
-pub(crate) use layer::RequestContextLayer;
+pub(crate) use layer::{RequestContextLayer, is_sts_query_request};
 pub(crate) use module_switch::{
    MODULE_SWITCHES_SIGNAL_SUBSYSTEM, ModuleSwitchSnapshot, ModuleSwitchSource, PersistedModuleSwitches,
    current_module_switch_snapshot, refresh_persisted_module_switches_from, refresh_persisted_module_switches_from_store,
@@ -164,15 +164,26 @@ pub fn extract_request_id_from_headers(headers: &HeaderMap) -> String {
    let request_id = headers
        .get(REQUEST_ID_HEADER)
        .and_then(|v| v.to_str().ok())
+        .filter(|value| !value.trim().is_empty())
        .map(String::from)
-        .or_else(|| headers.get(AMZ_REQUEST_ID).and_then(|v| v.to_str().ok()).map(String::from))
-        .unwrap_or_else(generate_fallback_request_id);
+        .or_else(|| {
+            headers
+                .get(AMZ_REQUEST_ID)
+                .and_then(|v| v.to_str().ok())
+                .filter(|value| !value.trim().is_empty())
+                .map(String::from)
+        });

-    if !headers.contains_key(REQUEST_ID_HEADER) && !headers.contains_key(AMZ_REQUEST_ID) {
-        counter!("rustfs_log_chain_fallback_request_id_total", "source" => "headers_missing").increment(1);
+    if request_id.is_none() {
+        let source = if headers.contains_key(REQUEST_ID_HEADER) || headers.contains_key(AMZ_REQUEST_ID) {
+            "headers_empty_or_invalid"
+        } else {
+            "headers_missing"
+        };
+        counter!("rustfs_log_chain_fallback_request_id_total", "source" => source).increment(1);
    }

-    request_id
+    request_id.unwrap_or_else(generate_fallback_request_id)
 }

 /// Spawn a request-internal task that inherits the current tracing span.
@@ -283,6 +294,21 @@ mod tests {
        assert_eq!(id, "x-req-789");
    }

+    #[test]
+    fn test_extract_request_id_ignores_empty_header_values() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-request-id", http::HeaderValue::from_static(""));
+        headers.insert("x-amz-request-id", http::HeaderValue::from_static("amz-req-000"));
+        assert_eq!(extract_request_id_from_headers(&headers), "amz-req-000");
+
+        headers.insert(
+            "x-amz-request-id",
+            http::HeaderValue::from_bytes(b" \t").expect("optional whitespace is a valid header value"),
+        );
+        let id = extract_request_id_from_headers(&headers);
+        assert!(id.starts_with("req-"), "empty request ID headers must generate a fallback ID");
+    }
+
    #[test]
    fn test_extract_trace_context_ids_from_traceparent_header() {
        global::set_text_map_propagator(TraceContextPropagator::new());