对象存储 OSS：服务端签名直传

Java

在Maven项目中，导入以下依赖。

<!-- https://mvnrepository.com/artifact/com.aliyun/credentials-java -->
<dependency>
    <groupId>com.aliyun</groupId>
    <artifactId>credentials-java</artifactId>
    <version>0.3.4</version>
</dependency>

<dependency>
    <groupId>com.aliyun.kms</groupId>
    <artifactId>kms-transfer-client</artifactId>
    <version>0.1.0</version>
</dependency>

<dependency>
    <groupId>com.aliyun.oss</groupId>
    <artifactId>aliyun-sdk-oss</artifactId>
    <version>3.17.4</version>
</dependency>
<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>sts20150401</artifactId>
  <version>1.1.6</version>
</dependency>

您可以参考如下代码来完成服务端获取临时访问凭证并计算POST签名：

package com.sanfeng.oss.serversigneddirectupload.demos.web;

import com.aliyun.sts20150401.models.AssumeRoleResponse;
import com.aliyun.sts20150401.models.AssumeRoleResponseBody;
import com.aliyun.tea.TeaException;
import com.aliyun.oss.common.utils.BinaryUtil;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.commons.codec.binary.Base64;
import org.springframework.http.ResponseEntity;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.time.*;
import java.time.format.DateTimeFormatter;
import java.util.*;

@Controller
public class WebController {

    //OSS基础信息 替换为实际的 bucket 名称和 region-id
    String bucket = "web-direct-upload";
    String region = "cn-hangzhou";

    String host = "http://" + bucket + ".oss-" + region + ".aliyuncs.com";
    //指定上传到OSS的文件前缀。
    String upload_dir = "dir";
    //指定过期时间，单位为秒。
    Long expire_time = 3600L;

    /**
     * 通过指定有效的时长（秒）生成过期时间。
     * @param seconds 有效时长（秒）。
     * @return ISO8601 时间字符串，如："2014-12-01T12:00:00.000Z"。
     */
    public static String generateExpiration(long seconds) {
        // 获取当前时间戳（以秒为单位）
        long now = Instant.now().getEpochSecond();
        // 计算过期时间的时间戳
        long expirationTime = now + seconds;
        // 将时间戳转换为Instant对象，并格式化为ISO8601格式
        Instant instant = Instant.ofEpochSecond(expirationTime);
        // 定义时区
        ZoneId zone = ZoneId.systemDefault();  // 使用系统默认时区
        // 将 Instant 转换为 ZonedDateTime
        ZonedDateTime zonedDateTime = instant.atZone(zone);
        // 定义日期时间格式，例如2023-12-03T13:00:00.000Z
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
        // 格式化日期时间
        String formattedDate = zonedDateTime.format(formatter);
        // 输出结果
        return formattedDate;
    }
    //初始化STS Client
    public static com.aliyun.sts20150401.Client createStsClient() throws Exception {
        // 工程代码泄露可能会导致 AccessKey 泄露，并威胁账号下所有资源的安全性。以下代码示例仅供参考。
        // 建议使用更安全的 STS 方式。
        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
                    // 必填，请确保代码运行环境设置了环境变量 OSS_ACCESS_KEY_ID。
                .setAccessKeyId(System.getenv("OSS_ACCESS_KEY_ID"))
                // 必填，请确保代码运行环境设置了环境变量 OSS_ACCESS_KEY_SECRET。
                .setAccessKeySecret(System.getenv("OSS_ACCESS_KEY_SECRET"));
        // Endpoint 请参考 https://api.aliyun.com/product/Sts
        config.endpoint = "sts.cn-hangzhou.aliyuncs.com";
        return new com.aliyun.sts20150401.Client(config);
    }

    //获取STS临时凭证
    public static AssumeRoleResponseBody.AssumeRoleResponseBodyCredentials getCredential() throws Exception {
        com.aliyun.sts20150401.Client client = WebController.createStsClient();
        com.aliyun.sts20150401.models.AssumeRoleRequest assumeRoleRequest = new com.aliyun.sts20150401.models.AssumeRoleRequest()
                .setRoleArn(System.getenv("OSS_ACCESS_KEY_ID"))
                .setRoleSessionName("yourRoleSessionName");// 自定义会话名称
        com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
        try {
            // 复制代码运行请自行打印 API 的返回值
            AssumeRoleResponse response = client.assumeRoleWithOptions(assumeRoleRequest, runtime);
            // credentials里包含了后续要用到的AccessKeyId、AccessKeySecret和SecurityToken。
            return response.body.credentials;
        } catch (TeaException error) {
            // 此处仅做打印展示，请谨慎对待异常处理，在工程项目中切勿直接忽略异常。
            // 错误 message
            System.out.println(error.getMessage());
            // 诊断地址
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        } catch (Exception _error) {
            TeaException error = new TeaException(_error.getMessage(), _error);
            // 此处仅做打印展示，请谨慎对待异常处理，在工程项目中切勿直接忽略异常。
            // 错误 message
            System.out.println(error.getMessage());
            // 诊断地址
            System.out.println(error.getData().get("Recommend"));
            com.aliyun.teautil.Common.assertAsString(error.message);
        }
        return null;
    }
    @GetMapping("/get_post_signature_for_oss_upload")
    public ResponseEntity<Map<String, String>> getPostSignatureForOssUpload() throws Exception {
        AssumeRoleResponseBody.AssumeRoleResponseBodyCredentials sts_data = getCredential();

        String accesskeyid =  sts_data.accessKeyId;
        String accesskeysecret =  sts_data.accessKeySecret;
        String securitytoken =  sts_data.securityToken;
        System.out.println("sts accesskeyid:"+accesskeyid);
        System.out.println("sts accesskeysecret:"+accesskeysecret);
        System.out.println("sts securitytoken:"+securitytoken);

        //获取x-oss-credential里的date，当前日期，格式为yyyyMMdd
        LocalDate today = LocalDate.now();
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyyMMdd");
        String date = today.format(formatter);

        //获取x-oss-date
        ZonedDateTime now = ZonedDateTime.now().withZoneSameInstant(java.time.ZoneOffset.UTC);
        DateTimeFormatter formatter2 = DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmss'Z'");
        String x_oss_date = now.format(formatter2);

        // 步骤1：创建policy。
        String x_oss_credential = accesskeyid + "/" + date + "/" + region + "/oss/aliyun_v4_request";
        
        ObjectMapper mapper = new ObjectMapper();

        Map<String, Object> policy = new HashMap<>();
        policy.put("expiration", generateExpiration(expire_time));

        List<Object> conditions = new ArrayList<>();

        Map<String, String> bucketCondition = new HashMap<>();
        bucketCondition.put("bucket", bucket);
        conditions.add(bucketCondition);

        Map<String, String> securityTokenCondition = new HashMap<>();
        securityTokenCondition.put("x-oss-security-token", securitytoken);
        conditions.add(securityTokenCondition);

        Map<String, String> signatureVersionCondition = new HashMap<>();
        signatureVersionCondition.put("x-oss-signature-version", "OSS4-HMAC-SHA256");
        conditions.add(signatureVersionCondition);

        Map<String, String> credentialCondition = new HashMap<>();
        credentialCondition.put("x-oss-credential", x_oss_credential); // 替换为实际的 access key id
        conditions.add(credentialCondition);

        Map<String, String> dateCondition = new HashMap<>();
        dateCondition.put("x-oss-date", x_oss_date);
        conditions.add(dateCondition);

        conditions.add(Arrays.asList("content-length-range", 1, 10240000));
        conditions.add(Arrays.asList("eq", "$success_action_status", "200"));
        conditions.add(Arrays.asList("starts-with", "$key", upload_dir));

        policy.put("conditions", conditions);

        String jsonPolicy = mapper.writeValueAsString(policy);

        // 步骤2：构造待签名字符串（StringToSign）。
        String stringToSign = new String(Base64.encodeBase64(jsonPolicy.getBytes()));
        // System.out.println("stringToSign: " + stringToSign);

        // 步骤3：计算SigningKey。
        byte[] dateKey = hmacsha256(("aliyun_v4" + accesskeysecret).getBytes(), date);
        byte[] dateRegionKey = hmacsha256(dateKey, region);
        byte[] dateRegionServiceKey = hmacsha256(dateRegionKey, "oss");
        byte[] signingKey = hmacsha256(dateRegionServiceKey, "aliyun_v4_request");
        // System.out.println("signingKey: " + BinaryUtil.toBase64String(signingKey));

        // 步骤4：计算Signature。
        byte[] result = hmacsha256(signingKey, stringToSign);
        String signature = BinaryUtil.toHex(result);
        // System.out.println("signature:" + signature);

        Map<String, String> response = new HashMap<>();
        // 将数据添加到 map 中
        response.put("version", "OSS4-HMAC-SHA256");
        // 这里是易错点，不能直接传policy，需要做一下Base64编码
        response.put("policy", stringToSign);
        response.put("credential", x_oss_credential);
        response.put("ossdate", x_oss_date);
        response.put("signature", signature);
        response.put("token", securitytoken);
        response.put("dir", upload_dir);
        response.put("host", host);
        // 返回带有状态码 200 (OK) 的 ResponseEntity，返回给Web端，进行PostObject操作
        return ResponseEntity.ok(response);
    }
    public static byte[] hmacsha256(byte[] key, String data) {
        try {
            // 初始化HMAC密钥规格，指定算法为HMAC-SHA256并使用提供的密钥。
            SecretKeySpec secretKeySpec = new SecretKeySpec(key, "HmacSHA256");

            // 获取Mac实例，并通过getInstance方法指定使用HMAC-SHA256算法。
            Mac mac = Mac.getInstance("HmacSHA256");
            // 使用密钥初始化Mac对象。
            mac.init(secretKeySpec);

            // 执行HMAC计算，通过doFinal方法接收需要计算的数据并返回计算结果的数组。
            byte[] hmacBytes = mac.doFinal(data.getBytes());

            return hmacBytes;
        } catch (Exception e) {
            throw new RuntimeException("Failed to calculate HMAC-SHA256", e);
        }
    }
}

Python

• 执行以下命令安装依赖。

  pip install flask
  pip install alibabacloud_tea_openapi alibabacloud_sts20150401 alibabacloud_credentials

• 请参考如下代码来完成Python服务端获取临时访问凭证STStoken并构建上传策略以计算POST签名。

  from flask import Flask, render_template, jsonify
  from alibabacloud_tea_openapi.models import Config
  from alibabacloud_sts20150401.client import Client as Sts20150401Client
  from alibabacloud_sts20150401 import models as sts_20150401_models
  from alibabacloud_credentials.client import Client as CredentialClient
  import os
  import json
  import base64
  import hmac
  import datetime
  import time
  import hashlib
  
  app = Flask(__name__)
  
  # 配置环境变量 OSS_ACCESS_KEY_ID, OSS_ACCESS_KEY_ID, OSS_STS_ROLE_ARN。
  access_key_id = os.environ.get('OSS_ACCESS_KEY_ID')
  access_key_secret = os.environ.get('OSS_ACCESS_KEY_SECRET')
  role_arn_for_oss_upload = os.environ.get('OSS_STS_ROLE_ARN')
  
  # 自定义会话名称
  role_session_name = 'role_session_name'  
  
  # 替换为实际的bucket名称和region_id
  bucket = 'examplebucket'
  region_id = 'cn-hangzhou'
  
  host = f'http://{bucket}.oss-cn-hangzhou.aliyuncs.com'
  
  # 指定过期时间，单位为秒
  expire_time = 3600  
  # 指定上传到OSS的文件前缀。
  upload_dir = 'dir'
  
  def hmacsha256(key, data):
      """
      计算HMAC-SHA256哈希值的函数
  
      :param key: 用于计算哈希的密钥，字节类型
      :param data: 要进行哈希计算的数据，字符串类型
      :return: 计算得到的HMAC-SHA256哈希值，字节类型
      """
      try:
          mac = hmac.new(key, data.encode(), hashlib.sha256)
          hmacBytes = mac.digest()
          return hmacBytes
      except Exception as e:
          raise RuntimeError(f"Failed to calculate HMAC-SHA256 due to {e}")
  
  @app.route("/")
  def hello_world():
      return render_template('index.html')
  
  @app.route('/get_post_signature_for_oss_upload', methods=['GET'])
  def generate_upload_params():
      # 初始化配置，直接传递凭据
      config = Config(
          region_id=region_id,
          access_key_id=access_key_id,
          access_key_secret=access_key_secret
      )
  
      # 创建 STS 客户端并获取临时凭证
      sts_client = Sts20150401Client(config=config)
      assume_role_request = sts_20150401_models.AssumeRoleRequest(
          role_arn=role_arn_for_oss_upload,
          role_session_name=role_session_name
      )
      response = sts_client.assume_role(assume_role_request)
      token_data = response.body.credentials.to_map()
  
      # 使用 STS 返回的临时凭据
      temp_access_key_id = token_data['AccessKeyId']
      temp_access_key_secret = token_data['AccessKeySecret']
      security_token = token_data['SecurityToken']
  
  
      now = int(time.time())
      # 将时间戳转换为datetime对象
      dt_obj = datetime.datetime.utcfromtimestamp(now)
      # 在当前时间增加3小时，设置为请求的过期时间
      dt_obj_plus_3h = dt_obj + datetime.timedelta(hours=3)
  
      # 请求时间
      dt_obj_1 = dt_obj.strftime('%Y%m%dT%H%M%S') + 'Z'
      # 请求日期
      dt_obj_2 = dt_obj.strftime('%Y%m%d')
      # 请求过期时间
      expiration_time = dt_obj_plus_3h.strftime('%Y-%m-%dT%H:%M:%S.000Z')
      
      # 构建 Policy 并生成签名
      policy = {
          "expiration": expiration_time,
          "conditions": [
              ["eq", "$success_action_status", "200"],
              {"x-oss-signature-version": "OSS4-HMAC-SHA256"},
              {"x-oss-credential": f"{temp_access_key_id}/{dt_obj_2}/cn-hangzhou/oss/aliyun_v4_request"},
              {"x-oss-security-token": security_token},
              {"x-oss-date": dt_obj_1},  
          ]
      }
      print(dt_obj_1)
      policy_str = json.dumps(policy).strip()
  
      # 步骤2：构造待签名字符串（StringToSign）
      stringToSign = base64.b64encode(policy_str.encode()).decode()
  
      # 步骤3：计算SigningKey
      dateKey = hmacsha256(("aliyun_v4" + temp_access_key_secret).encode(), dt_obj_2)
      dateRegionKey = hmacsha256(dateKey, "cn-hangzhou")
      dateRegionServiceKey = hmacsha256(dateRegionKey, "oss")
      signingKey = hmacsha256(dateRegionServiceKey, "aliyun_v4_request")
  
      # 步骤4：计算Signature
      result = hmacsha256(signingKey, stringToSign)
      signature = result.hex()
  
      # 组织返回数据
      response_data = {
          'policy': stringToSign,  #表单域
          'x_oss_signature_version': "OSS4-HMAC-SHA256",  #指定签名的版本和算法，固定值为OSS4-HMAC-SHA256
          'x_oss_credential': f"{temp_access_key_id}/{dt_obj_2}/cn-hangzhou/oss/aliyun_v4_request",  #指明派生密钥的参数集
          'x_oss_date': dt_obj_1,  #请求的时间
          'signature': signature,  #签名认证描述信息
          'host': host,
          'dir': upload_dir,
          'security_token': security_token  #安全令牌
  
      }
      return jsonify(response_data)
  
  if __name__ == "__main__":
      app.run(host="0.0.0.0", port=8000)