Object Storage Service:Implement server-side signing, direct upload, and upload callback in Go

Step 1: Configure the application server

1. Place the source code in the intended directory. In this example, the source code is placed in the /home/aliyun/aliyun-oss-appserver-go directory on Ubuntu 16.04.

2. Go to the directory. Open the appserver.go file. Modify the following snippet:

   // Enter your AccessKey ID. 
   var accessKeyId string = "<yourAccessKeyId>"
   
   // Enter your AccessKey secret. 
   var accessKeySecret string = "<yourAccessKeySecret>"
   
   // Set host to a value that is in the format of bucketname.endpoint. 
   var host string = "https://bucket-name.oss-cn-hangzhou.aliyuncs.com'"
   
   // Specify the URL of the application server to which an upload callback request is sent. Replace the IP address and port number with your actual information. 
   var callbackUrl string = "http://192.0.2.0:8888";
   
   // Specify the prefix for the name of the object you want to upload. 
   var upload_dir string = "user-dir-prefix/"
   
   // Specify the validity period in seconds for the upload policy. 
   var expire_time int64 = 30

   • accessKeyId: Enter your AccessKey ID.

   • accessKeySecret: Enter your AccessKey secret.

   • host: The format is https://bucketname.endpoint. Example: https://bucket-name.oss-cn-hangzhou.aliyuncs.com. For more information about endpoints, see Endpoint.

   • callbackUrl: Specify the callback URL of the application server to which an upload callback request is sent. This URL is used to communicate between the application server and OSS. After you upload an object, OSS uses the URL to send upload information to the application server. In this example, "http://192.0.2.0:1234" is the callback URL.

   • dir: Specify the prefix for the name of the object. You can also leave this parameter empty.

Step 2: Configure the client

1. Download the client source code to the local directory on the PC.

2. Decompress the package. Open the upload.js file. Find the following lines from the file:

   // serverUrl specifies the URL of the application server that returns information about the signature and upload policy. Replace the sample IP address and port number with your actual IP address and port number. 
   serverUrl ='http://192.0.2.0:8888'

3. Set serverUrl to the URL of the application server. In this example, serverUrl is set to 'http://192.0.2.0:1234'.

Step 3: Modify CORS configurations

When you use form upload to upload data from the client to OSS, a request that contains the Origin header is sent from the browser to OSS. OSS checks whether the request that contains the Origin header matches the cross-origin resource sharing (CORS) rules of the bucket. To allow POST-based uploads to the bucket from a different origin, you must configure a proper CORS rule.

1. Log on to the OSS console.

2. In the left-side navigation pane, click Buckets. On the Buckets page, find and click the desired bucket.

3. In the left-side navigation tree, choose Content Security > CORS.

4. On the CORS page, click Create Rule and configure the parameters in the Create Rule panel, as shown in the following figure.

   Note

   To ensure data security, we recommend that you specify exact domain names from which you want OSS to allow requests in Sources. For more information about CORS configurations, see Configure CORS.

Step 4: Upload a file

1. Start the application server.

   In the /home/aliyun/aliyun-oss-appserver-go directory, run the go run appserver.go 192.0.2.0 1234 command to start the application server.

   Note

   Replace the IP address and port number with the IP address and port number of your application server.

2. Start the client.

   1. Go to the local directory in which the client source code is stored and open the index.html file in a browser.

      Important

      The index.html file may be incompatible with Internet Explorer 10 or earlier. If you encounter any problems when you use Internet Explorer 10 or earlier, perform debugging.

   2. Click Select File and select a file of a supported type. Click Upload. After you upload the object, the content that is returned by the application server is displayed.

Core code of the application server

The source code of the application server implements signature-based direct upload and upload callbacks.

• Signature-based direct uploads

  The application server responds to the GET requests that are sent from a client. Sample code:

  func handlerRequest(w http.ResponseWriter, r *http.Request) {   
          if (r.Method == "GET") {
                  response := get_policy_token()
                  w.Header().Set("Access-Control-Allow-Methods", "POST")
                  w.Header().Set("Access-Control-Allow-Origin", "*")
                  io.WriteString(w, response)
          }

• Upload callbacks

  The application server responds to the POST message that is sent from OSS. Sample code

  if (r.Method == "POST") {
                  fmt.Println("\nHandle Post Request ... ")
  
                  // Get PublicKey bytes
                  bytePublicKey, err := getPublicKey(r)
                  if (err != nil) {
                          responseFailed(w)
                          return
                  }
  
                  // Get Authorization bytes : decode from Base64String
                  byteAuthorization, err := getAuthorization(r)
                  if (err != nil) {
                          responseFailed(w)
                          return
                  }
  
                  // Get MD5 bytes from Newly Constructed Authorization String. 
                  byteMD5, err := getMD5FromNewAuthString(r)
                  if (err != nil) {
                          responseFailed(w)
                          return
                  }
  
                  // verifySignature and response to client 
                  if (verifySignature(bytePublicKey, byteMD5, byteAuthorization)) {
                          // do something you want according to callback_body ...
  
                          responseSuccess(w)  // response OK : 200  
                  } else {
                          responseFailed(w)   // response FAILED : 400 
                  }
          }

  For more information, see Callback.