Signing Browser-Based Upload Requests

{ "expiration": "2024-12-31T12:00:00.000Z",
"conditions": [
{"x-obs-acl": "public-read" },
    {"x-obs-security-token": "YwkaRTbdY8g7q...." },
    {"bucket": "book" },
["starts-with", "$key", "user/"]
]
}

import java.text.SimpleDateFormat;↵
import java.util.ArrayList;↵
import java.util.Base64;↵
import java.util.Collections;↵
import java.util.Date;↵
import java.util.List;↵
import java.util.TimeZone;↵
↵
import javax.crypto.Mac;↵
import javax.crypto.spec.SecretKeySpec;↵
↵
public class SignDemo {↵
↵
    private static final String DEFAULT_ENCODING = "UTF-8";↵
    private static final String EXPIRATION_DATE_FORMATTER = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";↵
    private static final TimeZone GMT_TIMEZONE = TimeZone.getTimeZone("GMT");↵
    private static final long DEFAULT_EXPIRE_SECONDS = 300;↵
↵
    private String ak;↵
    private String sk;↵
↵
    private String join(List items) {↵
        StringBuilder sb = new StringBuilder();↵

        for (int i = 0; i < items.size(); i++) {
            String item = items.get(i).toString();sb.append(item);
            if (i < items.size() - 1) {
                sb.append(",");
            }
        }
        return sb.toString();
    }

    // Construct a StringToSign.
    private String stringToSign(String[] tmpConditions, String expiration) {
        List↵conditions = new ArrayList<>();
        Collections.addAll(conditions, tmpConditions);
        return "{\"expiration\":" + "\"" + expiration + "\"," + "\"conditions\":[" + join(conditions) + "]}";
    }

    private String getFormatExpiration(Date requestDate, long expires) {
        requestDate = requestDate != null ? requestDate : new Date();
        SimpleDateFormat expirationDateFormat = new SimpleDateFormat(EXPIRATION_DATE_FORMATTER);
        expirationDateFormat.setTimeZone(GMT_TIMEZONE);
        Date expiryDate = new Date(requestDate.getTime() + (expires <= 0 ? DEFAULT_EXPIRE_SECONDS : expires) * 1000);
        return expirationDateFormat.format(expiryDate);
    }

    // Calculate the signature.
    public String postSignature(String policy) throws Exception {
        byte[] policyBase64 = Base64.getEncoder().encode(policy.getBytes(DEFAULT_ENCODING));
        SecretKeySpec signingKey = new SecretKeySpec(this.sk.getBytes(DEFAULT_ENCODING), "HmacSHA1");
        Mac mac = Mac.getInstance("HmacSHA1");mac.init(signingKey);
        return Base64.getEncoder().encodeToString(mac.doFinal(policyBase64));
    }

    public static void main(String[] args) throws Exception {
    
        SignDemo demo = new SignDemo();

        /* Hard-coded or plaintext AK and SK are risky. For security purposes, encrypt your AK and SK and store them in the configuration file or environment variables.
        In this example, the AK and SK are stored in environment variables for identity authentication. Before running the code in this example, configure environment variables HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK. */
	demo.ak = System.getenv("HUAWEICLOUD_SDK_AK");
	demo.sk = System.getenv("HUAWEICLOUD_SDK_SK");

        String authExpiration = demo.getFormatExpiration(null, 0);  
        String[] tmpConditions = { "{\"bucket\": \"bucketName\" }", "[\"starts-with\", \"$key\", \"obj\"]" }; 
        String policy = demo.stringToSign(tmpConditions, authExpiration); 
        String policyBase64 = Base64.getEncoder().encodeToString(policy.getBytes(DEFAULT_ENCODING));  
        String signature = demo.postSignature(policy);  

        // Print the signature that carries AccessKeyId, policy, and Signature in a form.
        System.out.println("authExpiration=" + authExpiration); 
        System.out.println("policy=" + policy); 
        System.out.println("policyBase64=" + policyBase64); 
        System.out.println("Signature=" + signature); 
 
        // Print the signature that carries token in a form.
        System.out.println("token=" + demo.ak + ":" + signature + ":" + policyBase64); 
    }
}↵

# coding=utf-8
import binascii
import hashlib
import hmac
import os
import time
from datetime import datetime

import pytz

class SignatureDemo:
    EXPIRATION_DATE_FORMATTER = "%Y-%m-%dT%H:%M:%S.%f"

    DEFAULT_ENCODING = "UTF-8"

    # Set the default expiration time to 300 (5 minutes).
    DEFAULT_EXPIRE_SECONDS = 300

    GMT_TIMEZONE = "GMT"

    def __init__(self, ak=None, sk=None):
        self.ak = ak
        self.sk = sk

    # Specify request_date and expires as timestamps, for example, 1675651495.979.
    def get_format_expiration(self, request_date, expires):
        request_date = request_date if request_date else time.time()
        expiry_date = request_date + (expires if expires > 0 else self.DEFAULT_EXPIRE_SECONDS)
        expiration = datetime.fromtimestamp(expiry_date, pytz.timezone(self.GMT_TIMEZONE)).strftime(
            self.EXPIRATION_DATE_FORMATTER)[:-3] + "Z"
        return expiration

    def post_signature(self, policy):
        # If binascii or encode("base64") is used, newline characters must be removed.
        policy_base64 = binascii.b2a_base64(policy.encode(self.DEFAULT_ENCODING)).rstrip()
        hashed = hmac.new(self.sk.encode(self.DEFAULT_ENCODING), policy_base64, hashlib.sha1)
        return binascii.b2a_base64(hashed.digest()).rstrip()

    @staticmethod
    def string_to_sign(conditions, expiration):
        return "{\"expiration\":" + "\"" + expiration + "\"," + "\"conditions\":[" + ",".join(conditions) + "]}"


if __name__ == "__main__":
    demo = SignatureDemo()

    # Hard-coded or plaintext AK and SK are risky. For security purposes, encrypt your AK and SK and store them in the configuration file or environment variables.
    # In this example, the AK and SK are stored in environment variables used for identity authentication. Before running the code in this example, configure environment variables HUAWEICLOUD_SDK_AK and HUAWEICLOUD_SDK_SK.
    demo.ak = os.getenv('HUAWEICLOUD_SDK_AK')
    demo.sk = os.getenv('HUAWEICLOUD_SDK_SK')

    auth_expiration = demo.get_format_expiration(None, 0)
    conditions_example = [
        "{\"bucket\": \"bucketName\" }",
        "[\"starts-with\", \"$key\", \"obj\"]"
    ]

    post_policy = demo.string_to_sign(conditions_example, auth_expiration)
    policy_base64 = binascii.b2a_base64(post_policy.encode(demo.DEFAULT_ENCODING)).rstrip()

    signature = demo.post_signature(post_policy)

    # Print the signature that carries AccessKeyId, policy, and signature in a form.
    print("authExpiration=" + auth_expiration)
    print("policy=" + post_policy)
    print("policyBase64=" + policy_base64)
    print("Signature=" + signature)

    # Print the signature that carries token in a form.
    print("token=" + demo.ak + ":" + signature + ":" + policy_base64)