Object Storage Service：在Header中包含V4簽名（推薦）

SDK簽名實現

OSS SDK已實現自動完成V4簽名。採用OSS SDK的方式發起請求，可以免去手動簽名的過程。如何在初始化用戶端時使用V4簽名，以及SDK如何?V4簽名的程式碼範例如下表所示：

Authorization參數說明

如果上述方式無法滿足您的需求，例如使用REST API發起請求時，您需要手動計算SDK簽名，需要擷取發起REST API請求時所需的Authorization參數。Authorization欄位以空格的形式分隔簽名版本和簽名資訊。

• 格式

  Authorization: "OSS4-HMAC-SHA256 Credential=" + AccessKeyId + "/" + SignDate + "/" + SignRegion + "/oss/aliyun_v4_request, " + [ "AdditionalHeaders=" + AdditionalHeadersVal + ", " ] + "Signature=" + SignatureVal

• 樣本

  Authorization: OSS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20231203/cn-hangzhou/oss/aliyun_v4_request, AdditionalHeaders=host;userdefine, Signature=4b663e424d2db9967401ff6ce1c86f8c83cabd77d9908475239d9110642c63fa

簽名計算流程

如下是簽名計算流程圖。

• 步驟一：通過Http verb等參數構建出的CanonicalReques字串保留，在之後需要經過Hash轉化；

• 步驟二：將步驟一中獲得的CanonicalRequest進行一次sha256Hex轉換得到字串“XXX”，再將"OSS4-HMAC-SHA256"等參數與所得到的字串“XXX”拼接，構建出StringToSign；

• 步驟三：根據圖示使用HMAC-SHA256格式逐步轉換封裝參數，構建出SigningKey，最後將SigningKey與步驟二中獲得的StringToSign使用HMAC-SHA256格式轉換，得到的字串就是Signature的值。

關於每個步驟的具體參數說明，請參考流程圖下方各步驟內容。具體計算過程樣本，請參考簽名計算樣本。

HTTP Verb + "\n" +
Canonical URI + "\n" +
Canonical Query String + "\n" +
Canonical Headers + "\n" +
Additional Headers + "\n" +
Hashed PayLoad

"GET" | "PUT" | ... + "\n" +
UrlEncode(<Resource>) + "\n" +
UrlEncode(<QueryParam1>) + "=" + UrlEncode(<Value>) + "&" + UrlEncode(<QueryParam2>) + "\n" +
Lowercase(<HeaderName1>) + ":" + Trim(<value>) + "\n" + Lowercase(<HeaderName2>) + ":" + Trim(<value>) + "\n" + 
Lowercase(<AdditionalHeaderName1>) + ";" + Lowercase(<AdditionalHeaderName2>) + "\n" +
UNSIGNED-PAYLOAD

簽名計算樣本

以PutObject為例，示範如何在Header包含V4簽名。

• 計算樣本參數說明

  參數	值
  AccessKeyId	accesskeyid
  AccessKeySecret	accesskeysecret
  Timestamp	20231203T121212Z
  Bucket	examplebucket
  Object	exampleobject
  Region	cn-hangzhou

• PutObject

  PUT /exampleobject HTTP/1.1
  Content-MD5: eB5eJF1ptWaXm4bijSPyxw
  Content-Type: text/html
  Date: Sun, 03 Dec 2023 12:12:12 GMT
  Host: examplebucket.oss-cn-hangzhou.aliyuncs.com
  Authorization: SignatureToBeCalculated
  x-oss-date: 20231203T121212Z 
  x-oss-meta-author: alice
  x-oss-meta-magic: abracadabra
  x-oss-content-sha256: UNSIGNED-PAYLOAD

• 在Header包含V4簽名的步驟如下：

  1. 構造出的CanonicalRequest格式如下。

     PUT
     /examplebucket/exampleobject
     
     content-md5:eB5eJF1ptWaXm4bijSPyxw
     content-type:text/html
     host:examplebucket.oss-cn-hangzhou.aliyuncs.com
     x-oss-content-sha256:UNSIGNED-PAYLOAD
     x-oss-date:20231203T121212Z
     x-oss-meta-author:alice
     x-oss-meta-magic:abracadabra
     
     host
     UNSIGNED-PAYLOAD

  2. 構造待簽名字串（StringToSign）格式如下。

     OSS4-HMAC-SHA256
     20231203T121212Z
     20231203/cn-hangzhou/oss/aliyun_v4_request
     129b14df88496f434606e999e35dee010ea1cecfd3ddc378e5ed4989609c1db3

  3. 計算簽名。

     1. 計算SigningKey。

        HMAC-SHA256(HMAC-SHA256(HMAC-SHA256(HMAC-SHA256("aliyun_v4" + "accesskeysecret", "20231203"), "cn-hangzhou"), "oss"), "aliyun_v4_request");

     2. 通過計算公式逐層計算得到Signature，結果格式樣本如下。

        說明

        計算公式為Signature = HEX(HMAC-SHA256(Signingkey,StringToSign));

        4b663e424d2db9967401ff6ce1c86f8c83cabd77d9908475239d9110642c63fa

  4. 將簽名添加到Authorization中。

     OSS4-HMAC-SHA256 Credential=accesskeyid/20231203/cn-hangzhou/oss/aliyun_v4_request,AdditionalHeaders=host,Signature=4b663e424d2db9967401ff6ce1c86f8c83cabd77d9908475239d9110642c63fa

• 程式碼範例

import com.aliyun.oss.common.utils.BinaryUtil;
import org.apache.commons.codec.digest.DigestUtils;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;


/**
 * Signature Demo
 */
public class Demo1 {

    /**
     * 簽名計算工具
     *
     * @return Authorization
     */
    public static void main(String[] args) throws Exception {
        // 步驟1：構造CanonicalRequest
        String canonicalRequest =
                "PUT\n" +
                        "/examplebucket/exampleobject\n" +
                        "\n" +
                        "content-md5:eB5eJF1ptWaXm4bijSPyxw\n" +
                        "content-type:text/html\n" +
                        "host:examplebucket.oss-cn-hangzhou.aliyuncs.com\n" +
                        "x-oss-content-sha256:UNSIGNED-PAYLOAD\n" +
                        "x-oss-date:20231203T121212Z\n" +
                        "x-oss-meta-author:alice\n" +
                        "x-oss-meta-magic:abracadabra\n" +
                        "\n" +
                        "host\n" +
                        "UNSIGNED-PAYLOAD";

        // 步驟2：構造待簽名字串（StringToSign）
        String stringToSign = "OSS4-HMAC-SHA256\n" +
                "20231203T121212Z\n" +
                "20231203/cn-hangzhou/oss/aliyun_v4_request\n" +
                DigestUtils.sha256Hex(canonicalRequest);

        // 步驟3：計算Signature。
        // "accesskeysecret"填入RAM使用者的AccessKeySecret，data參數填入實際日期如"20231203”
        byte[] dateKey = hmacsha256(("aliyun_v4" + "accesskeysecret").getBytes(), "20231203");
        // 參數填入所在地區，如所在地區為杭州則填入"cn-hangzhou”
        byte[] dateRegionKey = hmacsha256(dateKey, "cn-hangzhou");
        byte[] dateRegionServiceKey = hmacsha256(dateRegionKey, "oss");
        byte[] signingKey = hmacsha256(dateRegionServiceKey, "aliyun_v4_request");

        byte[] result = hmacsha256(signingKey, stringToSign);
        String signature = BinaryUtil.toHex(result);
        System.out.println("signature:" + signature);

        String authorization = "OSS4-HMAC-SHA256 " +
                "Credential=accesskeyid/20231203/cn-hangzhou/oss/aliyun_v4_request," +
                "AdditionalHeaders=host," +
                "Signature=" + signature;

        System.out.println("Authorization:" + authorization);
    }

    public static byte[] hmacsha256(byte[] key, String data) {
        try {
            // 初始化HMAC密鑰規格，指定演算法為HMAC-SHA256並使用提供的密鑰。
            SecretKeySpec secretKeySpec = new SecretKeySpec(key, "HmacSHA256");

            // 擷取Mac執行個體，並通過getInstance方法指定使用HMAC-SHA256演算法。
            Mac mac = Mac.getInstance("HmacSHA256");
            // 使用密鑰初始化Mac對象。
            mac.init(secretKeySpec);

            // 執行HMAC計算，通過doFinal方法接收需要計算的資料並返回計算結果的數組。
            byte[] hmacBytes = mac.doFinal(data.getBytes());

            return hmacBytes;
        } catch (Exception e) {
            throw new RuntimeException("Failed to calculate HMAC-SHA256", e);
        }
    }
}