AWS Request Signing

On AWS, Gothic serves your app from a Lambda Function URL behind CloudFront, locked down with Origin Access Control (OAC). OAC only accepts requests that carry a valid SigV4 signature, and that signature includes a SHA-256 of the request body in the x-amz-content-sha256 header. Omit it or send the wrong value and the origin replies 403.

The body only exists in the browser, so the hash has to be computed there, as each request goes out. Without it, every POST, PUT, PATCH and DELETE would fail the moment it went behind the CDN.

How Gothic handles it

Signing lives in the Gothic core WASM and switches on only when GOTHIC_PROVIDER=AWS — the flag the deploy sets for you. It hooks htmx:configRequest and fills in x-amz-content-sha256 on every request by method:

# GET, DELETE — no body → the fixed empty-body hash
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

# POST, PUT, PATCH — SHA256 of the urlencoded form body
x-amz-content-sha256: <sha256 of the body>

# multipart uploads — streamed, so signed as an unsigned payload
x-amz-content-sha256: UNSIGNED-PAYLOAD

A request that fires during boot (an hx-trigger="load") is held until the signer is ready, so nothing ever goes out unsigned.

Everywhere else

Off AWS — Docker, a VPS, GCP, Azure, or local — the signer stays off. Nothing to enable, nothing to configure.

Coming from v2? The old amz-content-sha256 htmx extension is gone — it lives in the WASM core now — and gothic migrate-v3 removes the hx-ext attribute for you.

That covers the AWS building blocks. Ready to ship? Let's install the dependencies and deploy your app.