# URL中携带签名 #### 功能介绍 OBS服务支持用户构造一个特定操作的URL，这个URL的Query参数中会包含用户AK、签名、有效期等信息，任何拿到这个URL的人均可执行这个操作，OBS服务收到这个请求后认为该请求就是签发URL用户自己在执行操作。例如构造一个携带签名信息的下载对象的URL，拿到相应URL的人都能下载这个对象，但该URL只在Expires指定的失效时间内有效。URL中携带签名主要用于在不提供给其他人Secret Access Key的情况下，让其他人能用预签发的URL来进行身份认证，并执行预定义的操作。 URL中携带签名请求的示例如下： ``` GET /ObjectKey?AccessKeyId=AccessKeyID&Expires=ExpiresValue&Signature=signature HTTP/1.1 Host: bucketname.obs.cn-north-4.myhuaweicloud.com ``` URL中使用临时AK，SK和securitytoken下载对象消息格式如下： ``` GET /ObjectKey?AccessKeyId=AccessKeyID&Expires=ExpiresValue&Signature=signature&x-obs-security-token=securitytoken HTTP/1.1 Host: bucketname.obs.cn-north-4.myhuaweicloud.com ``` #### URL中的Query参数说明 如果选择URL中携带签名访问OBS，那么URL中必须携带如[表1]所示的Query参数： 表1URL中的Query参数说明 | **参数名称** | **参数类型** | **是否必选** | **描述** | |:---|:---|:---|:---| | AccessKeyId | String | 必选 | **参数解释：** URL签发者的访问密钥ID（AK），OBS根据AK确定签发者的身份，并认为URL就是签发者在访问。如何获取AK请参见：[管理访问密钥](https://support.huaweicloud.com/usermanual-ca/ca_01_0003.html) **约束限制：** 不涉及 **取值范围：** 不涉及 **默认取值：** 无 | | Expires | String | 必选 | **参数解释：** 签名失效的时间，此处以UNIX时间戳的形式来计量（以1970年1月1日零时为起点往后数秒），超过该时间后，URL签名失效。 **约束限制：** 不涉及 **取值范围：** 当前时间\ SUB_RESOURCES = Collections.unmodifiableList(Arrays.asList( "CDNNotifyConfiguration", "acl", "append", "attname", "backtosource", "cors", "customdomain", "delete", "deletebucket", "directcoldaccess", "encryption", "inventory", "length", "lifecycle", "location", "logging", "metadata", "mirrorBackToSource", "modify", "name", "notification", "obscompresspolicy", "orchestration", "partNumber", "policy", "position", "quota","rename", "replication", "response-cache-control", "response-content-disposition","response-content-encoding", "response-content-language", "response-content-type", "response-expires","restore", "storageClass", "storagePolicy", "storageinfo", "tagging", "torrent", "truncate", "uploadId", "uploads", "versionId", "versioning", "versions", "website", "x-image-process", "x-image-save-bucket", "x-image-save-object", "x-obs-security-token", "object-lock", "retention")); private String ak; private String sk; private boolean isBucketNameValid(String bucketName) { if (bucketName == null || bucketName.length() > 63 || bucketName.length() < 3) { return false; } if (!Pattern.matches("^[a-z0-9][a-z0-9.-]+$", bucketName)) { return false; } if (Pattern.matches("(\\d{1,3}\\.){3}\\d{1,3}", bucketName)) { return false; } String[] fragments = bucketName.split("\\."); for (int i = 0; i < fragments.length; i++) { if (Pattern.matches("^-.*", fragments[i]) || Pattern.matches(".*-$", fragments[i]) || Pattern.matches("^$", fragments[i])) { return false; } } return true; } // 将字符串进行UTF-8编码 public String encodeUrlString(String path) throws UnsupportedEncodingException { return URLEncoder.encode(path, DEFAULT_ENCODING) .replaceAll("\\+", "%20") .replaceAll("\\*", "%2A") .replaceAll("%7E", "~"); } public String encodeObjectName(String objectName) throws UnsupportedEncodingException { StringBuilder result = new StringBuilder(); String[] tokens = objectName.split("/"); for (int i = 0; i < tokens.length; i++) { result.append(this.encodeUrlString(tokens[i])); if (i < tokens.length - 1) { result.append("/"); } } return result.toString(); } private String join(List items, String delimiter) { StringBuilder sb = new StringBuilder(); for (int i = 0; i < items.size(); i++) { String item = items.get(i).toString(); sb.append(item); if (i < items.size() - 1) { sb.append(delimiter); } } return sb.toString(); } private boolean isValid(String input) { return input != null && !input.equals(""); } public String hmacSha1(String input) throws NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException { SecretKeySpec signingKey = new SecretKeySpec(this.sk.getBytes(DEFAULT_ENCODING), "HmacSHA1"); // 获取Mac实例，并通过getInstance方法指定使用HMAC-SHA1算法 Mac mac = Mac.getInstance("HmacSHA1"); // 使用访问密钥SK初始化Mac对象 mac.init(signingKey); return Base64.getEncoder().encodeToString(mac.doFinal(input.getBytes(DEFAULT_ENCODING))); } // 构造StringToSign private String stringToSign(String httpMethod, Map headers, Map queries, String bucketName, String objectName, long expires) throws Exception { String contentMd5 = ""; String contentType = ""; TreeMap canonicalizedHeaders = new TreeMap(); String key; List temp = new ArrayList(); for (Map.Entry entry : headers.entrySet()) { key = entry.getKey(); if (key == null || entry.getValue() == null || entry.getValue().length == 0) { continue; } key = key.trim().toLowerCase(Locale.ENGLISH); if (key.equals("content-md5")) { contentMd5 = entry.getValue()[0]; continue; } if (key.equals("content-type")) { contentType = entry.getValue()[0]; continue; } if (key.startsWith(OBS_PREFIX)) { for (String value : entry.getValue()) { if (value != null) { temp.add(value.trim()); } } canonicalizedHeaders.put(key, this.join(temp, ",")); temp.clear(); } } // 构造StringToSign，拼接HTTP-Verb、Content-MD5、Content-Type、Expires StringBuilder stringToSign = new StringBuilder(); stringToSign.append(httpMethod).append(SIGN_SEP) .append(contentMd5).append(SIGN_SEP) .append(contentType).append(SIGN_SEP) .append(expires).append(SIGN_SEP); // 构造StringToSign，拼接CanonicalizedHeaders for (Map.Entry entry : canonicalizedHeaders.entrySet()) { stringToSign.append(entry.getKey()).append(":").append(entry.getValue()).append(SIGN_SEP); } // 构造StringToSign，拼接CanonicalizedResource stringToSign.append("/"); if (this.isValid(bucketName)) { stringToSign.append(bucketName).append("/"); if (this.isValid(objectName)) { stringToSign.append(this.encodeObjectName(objectName)); } } TreeMap canonicalizedResource = new TreeMap(); for (Map.Entry entry : queries.entrySet()) { key = entry.getKey(); if (key == null) { continue; } if (SUB_RESOURCES.contains(key)) { canonicalizedResource.put(key, entry.getValue()); } } if (canonicalizedResource.size() > 0) { stringToSign.append("?"); for (Map.Entry entry : canonicalizedResource.entrySet()) { stringToSign.append(entry.getKey()); if (this.isValid(entry.getValue())) { stringToSign.append("=").append(entry.getValue()); } stringToSign.append("&"); } stringToSign.deleteCharAt(stringToSign.length() - 1); } // 403报错的情况下，可以打印stringtosign定位问题 // System.out.println(String.format("StringToSign:%s%s", SIGN_SEP, stringToSign.toString())); return stringToSign.toString(); } public String querySignature(String httpMethod, Map headers, Map queries, String bucketName, String objectName, long expires) throws Exception { if (!isBucketNameValid(bucketName)) { throw new IllegalArgumentException("the bucketName is illegal"); } // 构造StringToSign String stringToSign = this.stringToSign(httpMethod, headers, queries, bucketName, objectName, expires); // 计算签名 return this.encodeUrlString(this.hmacSha1(stringToSign)); } public String querySignature(String httpMethod, Map headers, Map queries, long expires) throws Exception { // 构造StringToSign String stringToSign = this.stringToSign(httpMethod, headers, queries, "", "", expires); // 计算签名 return this.encodeUrlString(this.hmacSha1(stringToSign)); } public String getURL(String endpoint, Map queries, String bucketName, String objectName, String signature, long expires) throws UnsupportedEncodingException { StringBuilder URL = new StringBuilder(); if (bucketName == null || bucketName.isEmpty()) { URL.append("https://").append(endpoint).append("/").append(this.encodeObjectName(objectName)).append("?"); } else { URL.append("https://").append(bucketName).append(".").append(endpoint).append("/").append(this.encodeObjectName(objectName)).append("?"); } String key; for (Map.Entry entry : queries.entrySet()) { key = entry.getKey(); if (key == null) { continue; } if (SUB_RESOURCES.contains(key)) { String value = entry.getValue(); URL.append(key); if (value != null) { URL.append("=").append(value).append("&"); } else { URL.append("&"); } } } URL.append("AccessKeyId=").append(this.ak).append("&Expires=").append(expires).append("&Signature=").append(signature); return URL.toString(); } public static void listBucketSignatureUrl(SignDemo demo, Map headers, Map queries, String endpoint) throws Exception { // 请求消息参数Expires，设置24小时后失效 long expires = (System.currentTimeMillis() + 86400000L) / 1000; // 列举桶请求，没有桶名对象名 String signature = demo.querySignature("GET", headers, queries, expires); System.out.println(signature); String URL = demo.getURL(endpoint, queries, "", "", signature, expires); System.out.println(URL); } public static void signatureUrl(SignDemo demo, Map headers, Map queries, String endpoint) throws Exception { String bucketName = "bucket-test"; String objectName = "hello.jpg"; // 请求消息参数Expires，设置24小时后失效 long expires = (System.currentTimeMillis() + 86400000L) / 1000; String signature = demo.querySignature("GET", headers, queries, bucketName, objectName, expires); System.out.println(signature); String URL = demo.getURL(endpoint, queries, bucketName, objectName, signature, expires); System.out.println(URL); } public static void main(String[] args) throws Exception { SignDemo demo = new SignDemo(); /* 认证用的ak和sk硬编码到代码中或者明文存储都有很大的安全风险，建议在配置文件或者环境变量中密文存放，使用时解密，确保安全； 本示例以ak和sk保存在环境变量中为例，运行本示例前请先在本地环境中设置环境变量HUAWEICLOUD_SDK_AK和HUAWEICLOUD_SDK_SK。*/ demo.ak = System.getenv("HUAWEICLOUD_SDK_AK"); demo.sk = System.getenv("HUAWEICLOUD_SDK_SK"); String endpoint = ""; // 如果直接使用URL在浏览器地址栏中访问，无法带上头域，此处headers加入头域会导致签名不匹配，使用headers需要客户端处理 Map headers = new HashMap(); Map queries = new HashMap(); // 列举桶 listBucketSignatureUrl(demo, headers, queries, endpoint); // 非列举桶 signatureUrl(demo, headers, queries, endpoint); } } ``` - [C语言中签名的计算方法] 请单击[此处](https://obs-community.obs.cn-north-1.myhuaweicloud.com/sign/signature_c.zip)，下载C语言签名计算代码样例，其中： 1. 计算签名的接口包含在sign.h头文件中。 2. 计算签名的示例代码在main.c文件中。 #### 使用URL携带签名方式为浏览器生成预定义的URL 计算出签名，然后将Host作为URL的前缀，可以生成预定义的URL，如下面的示例所示，在浏览器中直接输入该地址则可以下载examplebucket桶中的objectkey对象。这个链接的有效期是1532779451(对应时间为：2018-07-28 12:04:11)。 ``` http(s)://examplebucket.obs.cn-north-4.myhuaweicloud.com/objectkey?AccessKeyId=AccessKeyID&Expires=1532779451&Signature=0Akylf43Bm3mD1bh2rM3dmVp1Bo%3D ``` 在Linux环境上使用curl命令访问注意\&字符需要\\转义，如下命令将对象objectkey下载到output文件中： ``` curl http(s)://examplebucket.obs.cn-north-4.myhuaweicloud.com/objectkey?AccessKeyId=AccessKeyID\&Expires=1532779451\&Signature=0Akylf43Bm3mD1bh2rM3dmVp1Bo%3D -X GET -o output ``` #### 签名不匹配报错处理 如果调用OBS API报如下错误： 状态码：403 Forbidden 错误码：SignatureDoesNotMatch 错误信息：The request signature we calculated does not match the signature you provided. Check your key and signing method. 请参考以下案例进行排查处理：[签名不匹配（SignatureDoesNotMatch）如何处理](https://support.huaweicloud.com/obs_faq/obs_faq_0173.html)