sigflint
github.com/bompus/sigflint- Category
- Developer Tools
- Rank
- No. 502Tools index
- Pricing
- Open Source
- Type
- TOOL
- GitHub
- 2 stars
- Latest release
- v1.0.3
- Date
About
sigflint is a dependency-free JavaScript library for AWS Signature Version 4 and SigV4a request signing, covering header-based signing, presigned URLs, chunked uploads and event streams, for S3 and any other AWS service, across Node.js, Bun, Deno, Cloudflare Workers and browsers. Its maintainer reports its signatures match botocore, the AWS CRT and the AWS SDK across a test corpus of over 6,500 requests and benchmarks it at roughly 1 microsecond per S3 signature, several times faster than the aws4 library in the same comparison.
What it does
AWS expects every API call to carry a signature computed from your secret key and a normalized copy of the request, a scheme called Signature Version 4. sigflint computes that signature and hands back the headers to attach, or a shareable link that expires on its own. It covers object storage and the other AWS services, the multi-region variant that signs with elliptic-curve keys, and large uploads signed piece by piece. It sends nothing itself: you give it a URL and credentials, it returns strings or bytes, and your own HTTP client makes the call.
Why it's ranked here
The case rests on correctness evidence most signing libraries never publish. The project checks its output against botocore, the signer inside the AWS Python SDK, on 3,360 storage requests and 1,622 requests to other services, and reports matching every one. In its own comparison the closest rival matched 92.6% of ordinary storage requests and 39.1% of edge cases. Zero runtime dependencies, an MIT license and a written security policy round it out. The caveat is that every figure comes from the maintainer's own harness, and the README states nothing has been sent to live AWS S3.
What's good
It decodes and re-encodes paths byte by byte, signs a stray percent sign literally instead of failing, and sorts repeated query parameters by name and then value, which is where the other libraries in its tables part ways with the reference. Each runtime gets its fastest hash: Bun's native hasher, Node's built-in crypto, or WebCrypto in Workers and browsers, chosen automatically at import. The TypeScript return type is a value-or-promise union, so a forgotten await is a compile error rather than an unsigned request. Unsafe input, such as a line break in a header value, throws instead of producing a signature AWS would reject.
Tradeoffs
Live-service testing is thin by the README's own account: one local S3-compatible test server and four read-only requests to Cloudflare R2. Those two servers disagree about a raw plus sign in a path, so you have to write it escaped. It does not hash binary bodies for you, and it ships no HTTP client, retries, credential loading or region lookup. The signing-key cache holds up to 1,000 entries under lookup strings that contain the secret key, which matters if process memory can be dumped. One person maintains it, and only the latest release receives security fixes.
How to use it well
Reach for it when you sign requests yourself somewhere the full AWS SDK is too heavy: an edge function, a Bun or Deno script, a browser upload through a presigned link, or a Cloudflare Worker without Node compatibility turned on. Always await the result so one code path runs on every runtime. Pass the region explicitly, because the default is empty and matches nothing. For big or binary uploads over HTTPS, mark the payload unsigned instead of hashing it. If you need credential refresh, retries or pagination, keep the official SDK; this covers the signature and nothing around it.
Technical notes+
package.json declares an ES module with sideEffects false, no dependencies (devDependencies only) and an exports map that routes the workerd, worker and browser conditions to src/web.js, the bun condition to a Bun build, node to a bundled Node build, and default to src/node.js. src/base.js holds the canonical-request logic with no imports: canonicalPath sends S3 through a single decode-then-encode pass over a lazily built 256-entry table ('+' signed as %20, an invalid escape as %25) and other services through dot-segment resolution plus double encoding; canonicalQuery has a fast path for plain, already-sorted queries before falling back to decoding, encoding and sorting pairs; signHeaderName throws a TypeError on x-amz-date, authorization, __proto__ or a CR/LF in a value. src/node.js computes HMAC-SHA-256 as two one-shot crypto.hash calls over preallocated ipad/opad buffers (data capped at 1,024 bytes, keys at 64), used only after a first-call probe agrees with createHmac. src/web.js derives keys through WebCrypto importKey/sign chains, caches up to 1,000 signing keys in a Map keyed by date, region, service and secret, and builds SigV4a keys by importing the derived P-256 scalar as a hand-assembled PKCS#8 DER prefix, retrying the counter up to 127 times; its chunk and event signers serialize calls through a promise chain so signatures stay ordered. index.d.ts types every signing return as MaybePromise<T>, which is what turns a missing await into a type error. SECURITY.md routes reports through GitHub private vulnerability reporting and limits fixes to the latest release.
Observed
- License
- MIT
- Language
- JavaScript ES module with TypeScript declarations generated from the source
- Runtime dependencies
- None; the manifest lists dev dependencies only
- Install
- npm install sigflint, or bun add sigflint
- Node.js requirement
- >=22.12.0 (engines field)
- Interface
- Library API: getAuthHeaders, presign, getAuthHeadersV4a, presignV4a, chunkSigner, eventSigner
- Runtimes supported
- Node.js, Bun, Deno, Cloudflare Workers with or without Node compatibility, browsers via WebCrypto
- Return type
- Synchronous on Node.js, Bun and Deno; a promise on Workers and browsers
- Out of scope
- HTTP client, retries, credential providers, region lookup, hashing binary bodies
- Secret handling
- Signing-key caches of up to 1,000 entries keyed by strings that contain the secret access key
- Vulnerability reporting
- GitHub private vulnerability reporting; fixes for the latest release only
Read from README.md, package.json, LICENSE, docs/guide.md, docs/benchmarks.md, src/base.js, src/node.js, src/web.js, index.d.ts, SECURITY.md.
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.