1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Base64;
import java.util.Date;
import java.util.List;
import java.util.TimeZone;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class SignDemo {

    private static final String DEFAULT_ENCODING = "UTF-8";

    private static final String EXPIRATION_DATE_FORMATTER = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";

    private static final TimeZone GMT_TIMEZONE = TimeZone.getTimeZone("GMT");

    private static final long DEFAULT_EXPIRE_SECONDS = 300;

    private String ak;

    private String sk;

    private String join(List items, String delimiter) {
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < items.size(); i++) {
            String item = items.get(i).toString();
            sb.append(item);
            if (i < items.size() - 1) {
                sb.append(delimiter);
            }
        }
        return sb.toString();
    }

    public String hmacSha1(String input)
        throws NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException {
        SecretKeySpec signingKey = new SecretKeySpec(this.sk.getBytes(DEFAULT_ENCODING), "HmacSHA1");
        Mac mac = Mac.getInstance("HmacSHA1");
        mac.init(signingKey);
        return Base64.getEncoder()
            .encodeToString(mac.doFinal(Base64.getEncoder().encode(input.getBytes(DEFAULT_ENCODING))));
    }

    private String stringToSign(List conditions, String expiration) {
        StringBuilder policy = new StringBuilder();
        policy.append("{\"expiration\":").append("\"").append(expiration).append("\",")
            .append("\"conditions\":[");

        policy.append(join(conditions, ","));
        policy.append("]}");
        return policy.toString();
    }

    private String getFormatExpiration(Date requestDate, long expires) {
        requestDate = requestDate != null ? requestDate : new Date();
        SimpleDateFormat expirationDateFormat = new SimpleDateFormat(EXPIRATION_DATE_FORMATTER);
        expirationDateFormat.setTimeZone(GMT_TIMEZONE);
        Date expiryDate = new Date(requestDate.getTime() + (expires <= 0 ? DEFAULT_EXPIRE_SECONDS : expires) * 1000);
        String expiration = expirationDateFormat.format(expiryDate);
        return expiration;
    }

    public String postSignature(List conditions, String expiration) throws Exception {
        return hmacSha1(this.stringToSign(conditions, expiration));
    }

    public static void main(String[] args) throws Exception {
        SignDemo demo = new SignDemo();

        /* 认证用的ak和sk硬编码到代码中或者明文存储都有很大的安全风险，建议在配置文件或者环境变量中密文存放，使用时解密，确保安全；
        本示例以ak和sk保存在环境变量中为例，运行本示例前请先在本地环境中设置环境变量HUAWEICLOUD_SDK_AK和HUAWEICLOUD_SDK_SK。*/
	demo.ak = System.getenv("HUAWEICLOUD_SDK_AK");
	demo.sk = System.getenv("HUAWEICLOUD_SDK_SK");

        String expiration = demo.getFormatExpiration(null, 0);
        List conditions = new ArrayList();
        String[] tmpConditions = {
            "{\"x-obs-acl\": \"public-read\" }",
            "{\"x-obs-security-token\": \"YwkaRTbdY8g7q....\" }",
            "{\"bucket\": \"book\" }",
            "[\"starts-with\", \"$key\", \"user/\"]"
        };
        for (String condition : tmpConditions) {
            conditions.add(condition);
        }

        System.out.println(expiration);
        System.out.println(demo.postSignature(conditions, expiration));
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

# coding=utf-8
import hashlib
import hmac
import time
import pytz
import binascii

from datetime import datetime


class SignatureDemo:
    EXPIRATION_DATE_FORMATTER = "%Y-%m-%dT%H:%M:%S.%f"

    DEFAULT_ENCODING = "UTF-8"

    # 默认过期时间五分钟
    DEFAULT_EXPIRE_SECONDS = 300

    GMT_TIMEZONE = "GMT"

    def __init__(self, ak=None, sk=None):
        self.ak = ak
        self.__sk = sk

    def set_secret_access_key(self, sk):
        self.__sk = sk

    # request_date和expires是timestamp形式 e.g. 1675651495.979
    def get_format_expiration(self, request_date, expires):
        request_date = request_date if request_date else time.time()
        expiry_date = request_date + (expires if expires > 0 else self.DEFAULT_EXPIRE_SECONDS)
        expiration = datetime.fromtimestamp(expiry_date, pytz.timezone(self.GMT_TIMEZONE)).strftime(
            self.EXPIRATION_DATE_FORMATTER)[:-3] + "Z"
        return expiration

    def hmac_sha1(self, ipt):
        # 如果使用binascii或encode("base64")， 需要去除换行符
        policy_base64 = binascii.b2a_base64(ipt.encode(self.DEFAULT_ENCODING)).rstrip()
        hashed = hmac.new(self.__sk.encode(self.DEFAULT_ENCODING), policy_base64, hashlib.sha1)
        return binascii.b2a_base64(hashed.digest()).rstrip()

    def post_signature(self, conditions, expiration):
        return self.hmac_sha1(self.string_to_sign(conditions, expiration))

    @staticmethod
    def string_to_sign(conditions, expiration):
        policy = ""
        policy += "{\"expiration\":" + "\"" + expiration + "\"," + "\"conditions\":["
        policy += ",".join(conditions) + "]}"
        return policy


if __name__ == "__main__":
    demo = SignatureDemo()

    # 认证用的ak和sk硬编码到代码中或者明文存储都有很大的安全风险，建议在配置文件或者环境变量中密文存放，使用时解密，确保安全；
    # 本示例以ak和sk保存在环境变量中为例，运行本示例前请先在本地环境中设置环境变量HUAWEICLOUD_SDK_AK和HUAWEICLOUD_SDK_SK。
    demo.ak = os.getenv('HUAWEICLOUD_SDK_AK')
    demo.set_secret_access_key(os.getenv('HUAWEICLOUD_SDK_SK'))

    exp = demo.get_format_expiration(None, 0)
    conditions_example = [
        "{\"x-obs-acl\": \"public-read\" }",
        "{\"x-obs-security-token\": \"YwkaRTbdY8g7q....\" }",
        "{\"bucket\": \"book\" }",
        "[\"starts-with\", \"$key\", \"user/\"]"
    ]
    print(exp)
    print(demo.post_signature(conditions_example, exp))