簽名校驗生成過程

1. 從請求鑒權頭Authorization中依次解析出生成簽名所需各基本元素信息：

    accessKey
    dateStamp
    regionName
    serviceName
    SignedHeaders
    Signature

2. 根據SignedHeaders把參與簽名的請求頭headerName按自然序排列并轉為小寫后用;連接進行拼接得到canonicalizedHeaderNames。

canonicalizedHeaderNames=headerName1;headerName2;headerName3...

3. 依據SignedHeaders中請求頭名稱從請求中取出對應請求頭值，按字母自然序排列按如下規則生成canonicalizedHeaders。

headerName1:headerValue1+"\n"+headerName2:headerValue2...

4. 將請求?后面的入參按自然序排列并按如下規則生成canonicalizedQueryParameters。

UriEncode(QueryParameter1)=UriEncode(value)&UriEncode(QueryParameter2)=UriEncode(value)...

5. 按如下規則生成canonicalRequest。

httpMethod + "\n" + canonicalUri + "\n" + canonicalizedQueryParameters+ "\n" +canonicalizedHeaders+ "\n" + canonicalizedHeaderNames+ "\n" + bodyHash

其中bodyHash為HMAC-SHA256("")，即e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

6. 按如下規則生成stringToSign。

AWS4-HMAC-SHA256+"\n"+{x-amz-date}+"\n"+dateStamp + "/" + regionName + "/" + serviceName + "/" + aws4_request + "\n"+Hex(HMAC-SHA256(canonicalRequest))

7. 最后按如下算法生成最終的signature。

DateKey=HMAC-SHA256("AWS4"+{SecrectKey}, dateStamp)
    DateRegionKey=HMAC-SHA256(DateKey, regionName)
    DateRegionServiceKey=HMAC-SHA256(DateRegionKey, serviceName)
    SigningKey=HMAC-SHA256(DateRegionServiceKey, "aws4_request")
    signature=Hex(HMAC-SHA256(SigningKey, stringToSign))

校驗實例demo

基礎信息

請求信息

• 接口完整地址：//vod-api.xstore.daliqc.cn/xstore-transcode/task
• 接口參數：taskId=0003#45559c3d411843c79410f538a205df7d
• 請求body為空，hashBody：e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

GET /xstore-transcode/task
host:vod-api.xstore.daliqc.cn
x-amz-date:20210422T015559Z
Authorization: SignatureToBeCalculated
x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

生成簽名各步結果

1. CanonicalRequest

GET
/xstore-transcode/task
taskId=0003%2345559c3d411843c79410f538a205df7d
host:vod-api.xstore.daliqc.cn
x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
x-amz-date:20210422T015559Z
host;x-amz-content-sha256;x-amz-date
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

2. StringToSign

AWS4-HMAC-SHA256
20210422T015559Z
20210422/cn-north-1/xs-transcode/aws4_request
002512aa3fd5e27993ff5492963f323ae7d651ce7c06c0991e29a95951d50991

3. Signature

53e377e7e2dcc33286c939f7681534762d55dc05cd6a078304b10a7dae6dfca1

4. Authorization

AWS4-HMAC-SHA256 Credential=35nwOnYWqcKvgCAX5MNi/20210422/cn-north-1/xs-transcode/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=53e377e7e2dcc33286c939f7681534762d55dc05cd6a078304b10a7dae6dfca1