基于浏览器上传的表单中携带签名

{ "expiration": "2024-12-31T12:00:00.000Z",
"conditions": [
{"x-obs-acl": "public-read" },
    {"x-obs-security-token": "YwkaRTbdY8g7q...." },
    {"bucket": "book" },
["starts-with", "$key", "user/"]
]
}

import java.text.SimpleDateFormat;↵
import java.util.ArrayList;↵
import java.util.Base64;↵
import java.util.Collections;↵
import java.util.Date;↵
import java.util.List;↵
import java.util.TimeZone;↵
↵
import javax.crypto.Mac;↵
import javax.crypto.spec.SecretKeySpec;↵
↵
public class SignDemo {↵
↵
    private static final String DEFAULT_ENCODING = "UTF-8";↵
    private static final String EXPIRATION_DATE_FORMATTER = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";↵
    private static final TimeZone GMT_TIMEZONE = TimeZone.getTimeZone("GMT");↵
    private static final long DEFAULT_EXPIRE_SECONDS = 300;↵
↵
    private String ak;↵
    private String sk;↵
↵
    private String join(List items) {↵
        StringBuilder sb = new StringBuilder();↵

        for (int i = 0; i < items.size(); i++) {
            String item = items.get(i).toString();sb.append(item);
            if (i < items.size() - 1) {
                sb.append(",");
            }
        }
        return sb.toString();
    }

    // 构造StringToSign
    private String stringToSign(String[] tmpConditions, String expiration) {
        List↵conditions = new ArrayList<>();
        Collections.addAll(conditions, tmpConditions);
        return "{\"expiration\":" + "\"" + expiration + "\"," + "\"conditions\":[" + join(conditions) + "]}";
    }

    private String getFormatExpiration(Date requestDate, long expires) {
        requestDate = requestDate != null ? requestDate : new Date();
        SimpleDateFormat expirationDateFormat = new SimpleDateFormat(EXPIRATION_DATE_FORMATTER);
        expirationDateFormat.setTimeZone(GMT_TIMEZONE);
        Date expiryDate = new Date(requestDate.getTime() + (expires <= 0 ? DEFAULT_EXPIRE_SECONDS : expires) * 1000);
        return expirationDateFormat.format(expiryDate);
    }

    // 计算签名
    public String postSignature(String policy) throws Exception {
        byte[] policyBase64 = Base64.getEncoder().encode(policy.getBytes(DEFAULT_ENCODING));
        SecretKeySpec signingKey = new SecretKeySpec(this.sk.getBytes(DEFAULT_ENCODING), "HmacSHA1");
        Mac mac = Mac.getInstance("HmacSHA1");mac.init(signingKey);
        return Base64.getEncoder().encodeToString(mac.doFinal(policyBase64));
    }

    public static void main(String[] args) throws Exception {
    
        SignDemo demo = new SignDemo();

        /* 认证用的ak和sk硬编码到代码中或者明文存储都有很大的安全风险，建议在配置文件或者环境变量中密文存放，使用时解密，确保安全；
        本示例以ak和sk保存在环境变量中为例，运行本示例前请先在本地环境中设置环境变量HUAWEICLOUD_SDK_AK和HUAWEICLOUD_SDK_SK。*/
	demo.ak = System.getenv("HUAWEICLOUD_SDK_AK");
	demo.sk = System.getenv("HUAWEICLOUD_SDK_SK");

        String authExpiration = demo.getFormatExpiration(null, 0);  
        String[] tmpConditions = { "{\"bucket\": \"bucketName\" }", "[\"starts-with\", \"$key\", \"obj\"]" }; 
        String policy = demo.stringToSign(tmpConditions, authExpiration); 
        String policyBase64 = Base64.getEncoder().encodeToString(policy.getBytes(DEFAULT_ENCODING));  
        String signature = demo.postSignature(policy);  

        // 表单中携带AccessKeyId、policy、Signature的签名 
        System.out.println("authExpiration=" + authExpiration); 
        System.out.println("policy=" + policy); 
        System.out.println("policyBase64=" + policyBase64); 
        System.out.println("Signature=" + signature); 
 
        // 表单中携带token的签名 
        System.out.println("token=" + demo.ak + ":" + signature + ":" + policyBase64); 
    }
}↵

# coding=utf-8
import binascii
import hashlib
import hmac
import os
import time
from datetime import datetime

import pytz

class SignatureDemo:
    EXPIRATION_DATE_FORMATTER = "%Y-%m-%dT%H:%M:%S.%f"

    DEFAULT_ENCODING = "UTF-8"

    # 默认过期时间五分钟
    DEFAULT_EXPIRE_SECONDS = 300

    GMT_TIMEZONE = "GMT"

    def __init__(self, ak=None, sk=None):
        self.ak = ak
        self.sk = sk

    # request_date和expires是时间戳形式，例如：1675651495.979
    def get_format_expiration(self, request_date, expires):
        request_date = request_date if request_date else time.time()
        expiry_date = request_date + (expires if expires > 0 else self.DEFAULT_EXPIRE_SECONDS)
        expiration = datetime.fromtimestamp(expiry_date, pytz.timezone(self.GMT_TIMEZONE)).strftime(
            self.EXPIRATION_DATE_FORMATTER)[:-3] + "Z"
        return expiration

    def post_signature(self, policy):
        # 如果使用binascii或encode("base64")， 需要去除换行符
        policy_base64 = binascii.b2a_base64(policy.encode(self.DEFAULT_ENCODING)).rstrip()
        hashed = hmac.new(self.sk.encode(self.DEFAULT_ENCODING), policy_base64, hashlib.sha1)
        return binascii.b2a_base64(hashed.digest()).rstrip()

    @staticmethod
    def string_to_sign(conditions, expiration):
        return "{\"expiration\":" + "\"" + expiration + "\"," + "\"conditions\":[" + ",".join(conditions) + "]}"


if __name__ == "__main__":
    demo = SignatureDemo()

    # 认证用的ak和sk硬编码到代码中或者明文存储都有很大的安全风险，建议在配置文件或者环境变量中密文存放，使用时解密，确保安全；
    # 本示例以ak和sk保存在环境变量中为例，运行本示例前请先在本地环境中设置环境变量HUAWEICLOUD_SDK_AK和HUAWEICLOUD_SDK_SK。
    demo.ak = os.getenv('HUAWEICLOUD_SDK_AK')
    demo.sk = os.getenv('HUAWEICLOUD_SDK_SK')

    auth_expiration = demo.get_format_expiration(None, 0)
    conditions_example = [
        "{\"bucket\": \"bucketName\" }",
        "[\"starts-with\", \"$key\", \"obj\"]"
    ]

    post_policy = demo.string_to_sign(conditions_example, auth_expiration)
    policy_base64 = binascii.b2a_base64(post_policy.encode(demo.DEFAULT_ENCODING)).rstrip()

    signature = demo.post_signature(post_policy)

    # 表单中携带AccessKeyId、policy、signature的签名
    print("authExpiration=" + auth_expiration)
    print("policy=" + post_policy)
    print("policyBase64=" + policy_base64)
    print("Signature=" + signature)

    # 表单中携带token的签名
    print("token=" + demo.ak + ":" + signature + ":" + policy_base64)