Glossary
Canonical Request
A canonical request is the exact, normalized form of a request that a signature is actually computed over — headers ordered a specific way, values encoded a specific way — so that the party signing the request and the party verifying the signature are guaranteed to be working from an identical representation of it. Without this normalization step, two semantically identical requests could be represented as different byte sequences, causing a valid signature to fail verification purely due to formatting differences that have nothing to do with the request's actual authenticity.
This connects directly to canonicalization as a broader authorization concept: just as normalizing an input before a policy check prevents an equivalent-but-differently-encoded request from bypassing that check, normalizing a request before signing it prevents an equivalent-but-differently-encoded request from failing a legitimate signature verification it should have passed.