建構 HMAC 簽章
您可能使用 HMAC 認證,而不要使用記號型授權。
這些認證用來建立類似於 AWS Signature 第 4 版的授權標頭。 計算簽章可提供身分驗證及傳輸中資料完整性。 每個簽章都與要求的時間戳記相關聯,因此不可能重複使用 authorization 標頭。 標頭由四個元件組合:演算法宣告、認證資訊、簽署標頭及計算簽章。
AWS4-HMAC-SHA256 Credential={access-key}/{date}/{region}/s3/aws4_request,SignedHeaders=host;x-amz-date;{other-required-headers},Signature={signature}
日期以 YYYYMMDD
格式提供,而且該地區對應至所指定儲存區的位置,例如 us
。 一律需要 host
和 x-amz-date
標頭。 根據要求,可能還需要其他標頭(例如,在有效負載要求時,需要 x-amz-content-sha256
)。 需要重新計算每個個別要求的簽章,因此許多開發人員都偏好使用會自動產生 authorization 標頭的工具或
SDK。
建立 authorization
標頭
首先,我們需要以標準化格式建立要求。
- 宣告所使用的 HTTP 方法(例如
PUT
) - 定義以標準化形式存取的資源。 這是
http(s)://
與查詢字串之間的位址部分。 若為帳戶層次的要求(例如列出儲存區),則這只是/
。 - 如果有任何要求參數,它們必須以百分比編碼進行標準化(例如,空格會呈現為
%20
)並按字母順序排序。 - 標頭需要藉由移除空格、轉換為小寫,並為每個標頭新增換行來進行標準化,然後必須以 ASCII 順序排序。
- 以標準格式列出之後,則必須進行「簽署」。 這只會採用標頭名稱,而不是其值,並按字母順序列出它們,以分號區隔。所有要求都需要
Host
和x-amz-date
。 - 如果要求具有內文(例如上傳物件或建立新的 ACL 時),則必須使用 SHA-256 演算法來雜湊處理要求內文,並以 base-16 編碼的小寫字元表示。
- 結合以換行區隔的 HTTP 方法、標準化資源、標準化參數、標準化標頭、已簽署標頭及雜湊要求內文,以形成標準化要求。
接下來,我們需要組合 'string-to-sign',它將與簽章金鑰結合,以形成最終簽章。 string-to-sign 採用下列格式:
AWS4-HMAC-SHA256
{time}
{date}/{string}/s3/aws4_request
{hashed-standardized-request}
- 時間必須是現行世界標準時間,並根據 ISO 8601 規格予以格式化(例如
20161128T152924Z
)。 - 日期採用
YYYYMMDD
格式。 - 最後一行是先前建立並使用 SHA-256 演算法雜湊處理的標準化要求。
現在,我們需要計算簽章。
- 首先,需要透過帳戶的密碼存取金鑰、現行日期以及所使用的地區和 API 類型來計算簽章金鑰。
- 字串
AWS4
會新增為密碼存取金鑰的字首,然後使用該新字串作為雜湊處理日期的金鑰。 - 使用產生的雜湊作為雜湊處理地區的金鑰。
- 處理程序會繼續使用新的雜湊作為雜湊處理 API 類型的金鑰。
- 最後,使用最新的雜湊作為雜湊處理字串
aws4_request
以建立簽章金鑰的金鑰。 - 然後,使用簽章金鑰作為雜湊處理 string-to-sign 以產生最終簽章的金鑰。
現在,唯一剩下的步驟是組合 authorization
標頭,如下所示:
AWS4-HMAC-SHA256 Credential={access-key}/{date}/{region}/s3/aws4_request,SignedHeaders=host;x-amz-date;{other-required-headers},Signature={signature}
產生 authorization
標頭
Python 範例
import os
import datetime
import hashlib
import hmac
import requests
# please don't store credentials directly in code
access_key = os.environ.get('COS_HMAC_ACCESS_KEY_ID')
secret_key = os.environ.get('COS_HMAC_SECRET_ACCESS_KEY')
# request elements
http_method = 'GET'
host = 's3.us.cloud-object-storage.appdomain.cloud'
region = 'us-standard'
endpoint = 'https://s3.us.cloud-object-storage.appdomain.cloud'
bucket = '' # add a '/' before the bucket name to list buckets
object_key = ''
request_parameters = ''
# hashing and signing methods
def hash(key, msg):
return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest()
# region is a wildcard value that takes the place of the AWS region value
# as COS doen't use the same conventions for regions, this parameter can accept any string
def createSignatureKey(key, datestamp, region, service):
keyDate = hash(('AWS4' + key).encode('utf-8'), datestamp)
keyString = hash(keyDate, region)
keyService = hash(keyString, service)
keySigning = hash(keyService, 'aws4_request')
return keySigning
# assemble the standardized request
time = datetime.datetime.utcnow()
timestamp = time.strftime('%Y%m%dT%H%M%SZ')
datestamp = time.strftime('%Y%m%d')
standardized_resource = '/' + bucket + '/' + object_key
standardized_querystring = request_parameters
standardized_headers = 'host:' + host + '\n' + 'x-amz-date:' + timestamp + '\n'
signed_headers = 'host;x-amz-date'
payload_hash = hashlib.sha256(''.encode('utf-8')).hexdigest()
standardized_request = (http_method + '\n' +
standardized_resource + '\n' +
standardized_querystring + '\n' +
standardized_headers + '\n' +
signed_headers + '\n' +
payload_hash).encode('utf-8')
# assemble string-to-sign
hashing_algorithm = 'AWS4-HMAC-SHA256'
credential_scope = datestamp + '/' + region + '/' + 's3' + '/' + 'aws4_request'
sts = (hashing_algorithm + '\n' +
timestamp + '\n' +
credential_scope + '\n' +
hashlib.sha256(standardized_request).hexdigest())
# generate the signature
signature_key = createSignatureKey(secret_key, datestamp, region, 's3')
signature = hmac.new(signature_key,
(sts).encode('utf-8'),
hashlib.sha256).hexdigest()
# assemble all elements into the 'authorization' header
v4auth_header = (hashing_algorithm + ' ' +
'Credential=' + access_key + '/' + credential_scope + ', ' +
'SignedHeaders=' + signed_headers + ', ' +
'Signature=' + signature)
# create and send the request
headers = {'x-amz-date': timestamp, 'Authorization': v4auth_header}
# the 'requests' package autmatically adds the required 'host' header
request_url = endpoint + standardized_resource + standardized_querystring
print('\nSending `%s` request to IBM COS -----------------------' % http_method)
print('Request URL = ' + request_url)
request = requests.get(request_url, headers=headers)
print('\nResponse from IBM COS ----------------------------------')
print('Response code: %d\n' % request.status_code)
print(request.text)
Java 範例
import java.io.BufferedReader;
import java.io.DataOutputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.format.DateTimeFormatter;
import java.time.ZoneId;
import java.time.ZoneOffset;
import java.time.ZonedDateTime;
import java.util.Formatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
public class CosHMAC {
// please don't store credentials directly in code
private static final String accessKey = System.getenv("COS_HMAC_ACCESS_KEY_ID");
private static final String secretKey = System.getenv("COS_HMAC_SECRET_ACCESS_KEY");
// constants
private static final String httpMethod = "GET";
private static final String host = "s3.us.cloud-object-storage.appdomain.cloud";
private static final String region = "us-standard";
private static final String endpoint = "https://s3.us.cloud-object-storage.appdomain.cloud";
private static final String bucket = ""; // add a '/' before the bucket name to list buckets
private static final String objectKey = "";
private static final String requestParameters = "";
public static void main(String[] args) {
try {
// assemble the standardized request
ZonedDateTime time = ZonedDateTime.now(ZoneOffset.UTC);
String datestamp = time.format(DateTimeFormatter.ofPattern("yyyyMMdd"));
String timestamp = datestamp + "T" + time.format(DateTimeFormatter.ofPattern("HHmmss")) + "Z";
String standardizedResource = bucket + "/" + objectKey;
String standardizedQuerystring = requestParameters;
String standardizedHeaders = "host:" + host + "\n" + "x-amz-date:" + timestamp + "\n";
String signedHeaders = "host;x-amz-date";
String payloadHash = hashHex("");
String standardizedRequest = httpMethod + "\n" +
standardizedResource + "\n" +
standardizedQuerystring + "\n" +
standardizedHeaders + "\n" +
signedHeaders + "\n" +
payloadHash;
// assemble string-to-sign
String hashingAlgorithm = "AWS4-HMAC-SHA256";
String credentialScope = datestamp + "/" + region + "/" + "s3" + "/" + "aws4_request";
String sts = hashingAlgorithm + "\n" +
timestamp + "\n" +
credentialScope + "\n" +
hashHex(standardizedRequest);
// generate the signature
byte[] signatureKey = createSignatureKey(secretKey, datestamp, region, "s3");
String signature = hmacHex(signatureKey, sts);
// assemble all elements into the "authorization" header
String v4auth_header = hashingAlgorithm + " " +
"Credential=" + accessKey + "/" + credentialScope + ", " +
"SignedHeaders=" + signedHeaders + ", " +
"Signature=" + signature;
// create and send the request
String requestUrl = endpoint + standardizedResource + standardizedQuerystring;
URL urlObj = new URL(requestUrl);
HttpURLConnection con = (HttpURLConnection) urlObj.openConnection();
con.setRequestMethod(httpMethod);
//add request headers
con.setRequestProperty("x-amz-date", timestamp);
con.setRequestProperty("Authorization", v4auth_header);
System.out.printf("\nSending %s request to IBM COS -----------------------", httpMethod);
System.out.println("Request URL = " + requestUrl);
int responseCode = con.getResponseCode();
System.out.println("\nResponse from IBM COS ----------------------------------");
System.out.printf("Response code: %d\n\n", responseCode);
BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
response.append(inputLine);
}
in.close();
//print result
System.out.println(response.toString());
con.disconnect();
}
catch (Exception ex) {
System.out.printf("Error: %s\n", ex.getMessage());
}
}
private static String toHexString(byte[] bytes) {
Formatter formatter = new Formatter();
for (byte b : bytes) {
formatter.format("%02x", b);
}
return formatter.toString();
}
private static byte[] hash(byte[] key, String msg) {
byte[] returnVal = null;
try {
SecretKeySpec signingKey = new SecretKeySpec(key, "HmacSHA256");
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(signingKey);
returnVal = mac.doFinal(msg.getBytes("UTF8"));
}
catch (Exception ex) {
throw ex;
}
finally {
return returnVal;
}
}
private static String hmacHex(byte[] key, String msg) {
String returnVal = null;
try {
returnVal = toHexString(hash(key, msg));
}
catch (Exception ex) {
throw ex;
}
finally {
return returnVal;
}
}
private static String hashHex(String msg) {
String returnVal = null;
try {
MessageDigest digest = MessageDigest.getInstance("SHA-256");
byte[] encodedhash = digest.digest(msg.getBytes(StandardCharsets.UTF_8));
returnVal = toHexString(encodedhash);
}
catch (Exception ex) {
throw ex;
}
finally {
return returnVal;
}
}
// region is a wildcard value that takes the place of the AWS region value
// as COS doesn"t use the same conventions for regions, this parameter can accept any string
private static byte[] createSignatureKey(String key, String datestamp, String region, String service) {
byte[] returnVal = null;
try {
byte[] keyDate = hash(("AWS4" + key).getBytes("UTF8"), datestamp);
byte[] keyString = hash(keyDate, region);
byte[] keyService = hash(keyString, service);
byte[] keySigning = hash(keyService, "aws4_request");
returnVal = keySigning;
}
catch (Exception ex) {
throw ex;
}
finally {
return returnVal;
}
}
}
NodeJS 範例
const crypto = require('crypto');
const moment = require('moment');
const https = require('https');
// please don't store credentials directly in code
const accessKey = process.env.COS_HMAC_ACCESS_KEY_ID;
const secretKey = process.env.COS_HMAC_SECRET_ACCESS_KEY;
const httpMethod = 'GET';
const host = 's3.us.cloud-object-storage.appdomain.cloud';
const region = 'us-standard';
const endpoint = 'https://s3.us.cloud-object-storage.appdomain.cloud';
const bucket = ''; // add a '/' before the bucket name to list buckets
const objectKey = '';
const requestParameters = '';
// hashing and signing methods
function hash(key, msg) {
var hmac = crypto.createHmac('sha256', key);
hmac.update(msg, 'utf8');
return hmac.digest();
}
function hmacHex(key, msg) {
var hmac = crypto.createHmac('sha256', key);
hmac.update(msg, 'utf8');
return hmac.digest('hex');
}
function hashHex(msg) {
var hash = crypto.createHash('sha256');
hash.update(msg);
return hash.digest('hex');
}
// region is a wildcard value that takes the place of the AWS region value
// as COS doesn't use the same conventions for regions, this parameter can accept any string
function createSignatureKey(key, datestamp, region, service) {
keyDate = hash(('AWS4' + key), datestamp);
keyString = hash(keyDate, region);
keyService = hash(keyString, service);
keySigning = hash(keyService, 'aws4_request');
return keySigning;
}
// assemble the standardized request
var time = moment().utc();
var timestamp = time.format('YYYYMMDDTHHmmss') + 'Z';
var datestamp = time.format('YYYYMMDD');
var standardizedResource = bucket + '/' + objectKey;
var standardizedQuerystring = requestParameters;
var standardizedHeaders = 'host:' + host + '\n' + 'x-amz-date:' + timestamp + '\n';
var signedHeaders = 'host;x-amz-date';
var payloadHash = hashHex('');
var standardizedRequest = httpMethod + '\n' +
standardizedResource + '\n' +
standardizedQuerystring + '\n' +
standardizedHeaders + '\n' +
signedHeaders + '\n' +
payloadHash;
// assemble string-to-sign
var hashingAlgorithm = 'AWS4-HMAC-SHA256';
var credentialScope = datestamp + '/' + region + '/' + 's3' + '/' + 'aws4_request';
var sts = hashingAlgorithm + '\n' +
timestamp + '\n' +
credentialScope + '\n' +
hashHex(standardizedRequest);
// generate the signature
var signatureKey = createSignatureKey(secretKey, datestamp, region, 's3');
var signature = hmacHex(signatureKey, sts);
// assemble all elements into the 'authorization' header
var v4authHeader = hashingAlgorithm + ' ' +
'Credential=' + accessKey + '/' + credentialScope + ', ' +
'SignedHeaders=' + signedHeaders + ', ' +
'Signature=' + signature;
// create and send the request
var authHeaders = {'x-amz-date': timestamp, 'Authorization': v4authHeader}
// the 'requests' package autmatically adds the required 'host' header
console.log(authHeaders);
var requestUrl = endpoint + standardizedResource + standardizedQuerystring
console.log(`\nSending ${httpMethod} request to IBM COS -----------------------`);
console.log('Request URL = ' + requestUrl);
var options = {
host: host,
port: 443,
path: standardizedResource + standardizedQuerystring,
method: httpMethod,
headers: authHeaders
}
var request = https.request(options, function (response) {
console.log('\nResponse from IBM COS ----------------------------------');
console.log(`Response code: ${response.statusCode}\n`);
response.on('data', function (chunk) {
console.log(chunk.toString());
});
});
request.end();
下一步
您可以在 服務認證 中檢閱認證的文件。 如需鑑別的概觀,請參閱 IBM Cloud Identity and Access Management 服務。