Python
请参考如下代码来完成Python服务端的V4签名计算。
from flask import Flask, jsonify
import base64
import hmac
import hashlib
import os
import datetime
import json
import time
from alibabacloud_credentials.client import Client as CredClient
from alibabacloud_credentials.models import Config as CredConfig
app = Flask(__name__)
def hmacsha256(key, data):
"""
计算HMAC-SHA256哈希值的函数
:param key: 用于计算哈希的密钥，字节类型
:param data: 要进行哈希计算的数据，字符串类型
:return: 计算得到的HMAC-SHA256哈希值，字节类型
"""
try:
mac = hmac.new(key, data.encode(), hashlib.sha256)
hmacBytes = mac.digest()
return hmacBytes
except Exception as e:
raise RuntimeError(f"Failed to calculate HMAC-SHA256 due to {e}")
@app.route('/generate_signature', methods=['GET'])
def generate_signature():
"""
处理生成签名信息的请求，执行相关逻辑流程，包括获取环境变量、创建策略、构造待签名字符串、计算签名等操作，
并返回生成的签名信息。
:return: JSON格式的响应，包含签名信息的字典，格式如下：
{
"policy": "policy字符串",
"x-oss-signature-version": "OSS4-HMAC-SHA256",
"x-oss-credential": "accesskeyid/日期/cn-hangzhou/oss/aliyun_v4_request",
"x-oss-date": "请求时间",
"signature": "签名",
"security_token": "安全令牌"
}
"""
credentialConfig = CredConfig(
# 固定值无需更改
type='ecs_ram_role',
# 请替换为ECS扮演的角色名称
role_name='role_name'
)
credentialsClient = CredClient(credentialConfig)
credential = credentialsClient.get_credential()
# 获取AK
accesskeyid = credential.access_key_id
# 获取SK
accesskeysecret = credential.access_key_secret
# 获取Token
security_token = credential.security_token
now = int(time.time())
# 将时间戳转换为datetime对象
dt_obj = datetime.datetime.utcfromtimestamp(now)
# 在当前时间增加3小时，设置为请求的过期时间
dt_obj_plus_3h = dt_obj + datetime.timedelta(hours=3)
# 请求时间
dt_obj_1 = dt_obj.strftime('%Y%m%dT%H%M%S') + 'Z'
# 请求日期
dt_obj_2 = dt_obj.strftime('%Y%m%d')
# 请求过期时间
expiration_time = dt_obj_plus_3h.strftime('%Y-%m-%dT%H:%M:%S.000Z')
# 步骤1：创建policy。
policy = {
"expiration": expiration_time,
"conditions": [
{"bucket": "bucket_name"}, #请替换为目标Bucket名称
{"x-oss-signature-version": "OSS4-HMAC-SHA256"},
{"x-oss-credential": f"{accesskeyid}/{dt_obj_2}/cn-hangzhou/oss/aliyun_v4_request"},
{"x-oss-security-token": security_token},
{"x-oss-date": dt_obj_1},
]
}
policy_str = json.dumps(policy).strip()
# 步骤2：构造待签名字符串（StringToSign）
stringToSign = base64.b64encode(policy_str.encode()).decode()
# 步骤3：计算SigningKey
dateKey = hmacsha256(("aliyun_v4" + accesskeysecret).encode(), dt_obj_2)
dateRegionKey = hmacsha256(dateKey, "cn-hangzhou")
dateRegionServiceKey = hmacsha256(dateRegionKey, "oss")
signingKey = hmacsha256(dateRegionServiceKey, "aliyun_v4_request")
# 步骤4：计算Signature
result = hmacsha256(signingKey, stringToSign)
signature = result.hex()
return jsonify({
"policy": stringToSign, #表单域
"x_oss_signature_version": "OSS4-HMAC-SHA256", #指定签名的版本和算法，固定值为OSS4-HMAC-SHA256
"x_oss_credential": f"{accesskeyid}/{dt_obj_2}/cn-hangzhou/oss/aliyun_v4_request", #指明派生密钥的参数集
"x_oss_date": dt_obj_1, #请求的时间
"signature": signature, #签名认证描述信息
"security_token": security_token #安全令牌
})
if __name__ == "__main__":
app.run(host='0.0.0.0', port=5000)
Java
请参考如下代码来完成Java服务端的V4签名计算。您也可以下载完整的Spring Boot示例工程upload_server.zip运用到您的项目当中。
获取签名信息的工具类示例。
package com.example.demo.util;
import com.aliyun.credentials.models.CredentialModel;
import com.aliyun.oss.common.auth.Credentials;
import com.aliyun.oss.common.auth.CredentialsProvider;
import com.aliyun.oss.common.auth.DefaultCredentials;
import com.aliyun.oss.common.utils.BinaryUtil;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.commons.codec.binary.Base64;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.time.Instant;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import java.util.HashMap;
import java.util.Map;
// 用于生成阿里云POST文件上传所需签名及相关配置信息的工具类
public class GenerateSignature {
// 生成签名及相关配置信息的主要方法
public String getSignature() throws JsonProcessingException {
com.aliyun.credentials.models.Config config = new com.aliyun.credentials.models.Config();
config.setType("ecs_ram_role"); //固定值无需更改
config.setRoleName("roleName"); //请替换为ECS扮演的角色名称
final com.aliyun.credentials.Client credentialsClient = new com.aliyun.credentials.Client(config);
// 创建一个匿名内部类实现CredentialsProvider接口，用于提供阿里云OSS操作所需的凭证信息
CredentialsProvider credentialsProvider = new CredentialsProvider() {
@Override
public void setCredentials(Credentials credentials) {
}
@Override
public Credentials getCredentials() {
CredentialModel credential = credentialsClient.getCredential();
// 返回accessKeyId、secretAccessKey和securityToken
return new DefaultCredentials(credential.getAccessKeyId(), credential.getAccessKeySecret(), credential.getSecurityToken());
}
};
String accessKeyId = credentialsProvider.getCredentials().getAccessKeyId(); //获取AK
String secretAccessKey = credentialsProvider.getCredentials().getSecretAccessKey(); //获取SK
String securityToken = credentialsProvider.getCredentials().getSecurityToken(); //获取Token
// 格式化请求日期
long now = System.currentTimeMillis() / 1000;
ZonedDateTime dtObj = ZonedDateTime.ofInstant(Instant.ofEpochSecond(now), ZoneId.of("UTC"));
ZonedDateTime dtObjPlus3h = dtObj.plusHours(3); //在当前时间增加3小时，设置为请求的过期时间
//请求时间
DateTimeFormatter dtObj1Formatter = DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmss'Z'");
String dtObj1 = dtObj.format(dtObj1Formatter);
//请求日期
DateTimeFormatter dtObj2Formatter = DateTimeFormatter.ofPattern("yyyyMMdd");
String dtObj2 = dtObj.format(dtObj2Formatter);
//请求过期时间
DateTimeFormatter expirationTimeFormatter = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
String expirationTime = dtObjPlus3h.format(expirationTimeFormatter);
// 步骤1：创建policy
String policy = "{" +
"\"expiration\": \"" + expirationTime + "\"," +
"\"conditions\": [" +
"{\"bucket\": \"cjl2\"}," + //请替换为目标Bucket名称
"{\"x-oss-signature-version\": \"OSS4-HMAC-SHA256\"}," +
"{\"x-oss-credential\": \"" + accessKeyId + "/" + dtObj2 + "/cn-hangzhou/oss/aliyun_v4_request\"}," +
"{\"x-oss-security-token\": \"" + securityToken + "\"}," +
"{\"x-oss-date\": \"" + dtObj1 + "\"}" +
"]" +
"}";
// 步骤2：构造待签名字符串（StringToSign）
String stringToSign = new String(Base64.encodeBase64(policy.getBytes()));
// 步骤3：计算SigningKey
byte[] dateKey = hmacsha256(("aliyun_v4" + secretAccessKey).getBytes(), dtObj2);
byte[] dateRegionKey = hmacsha256(dateKey, "cn-hangzhou");
byte[] dateRegionServiceKey = hmacsha256(dateRegionKey, "oss");
byte[] signingKey = hmacsha256(dateRegionServiceKey, "aliyun_v4_request");
// 步骤4：计算Signature
byte[] result = hmacsha256(signingKey, stringToSign);
String signature = BinaryUtil.toHex(result);
Map<String, String> messageMap = new HashMap<>();
messageMap.put("security_token", securityToken); //安全令牌
messageMap.put("signature", signature); //签名认证描述信息
messageMap.put("x_oss_date", dtObj1); //请求的时间
messageMap.put("x_oss_credential", accessKeyId + "/" + dtObj2 + "/cn-hangzhou/oss/aliyun_v4_request"); //指明派生密钥的参数集
messageMap.put("x_oss_signature_version", "OSS4-HMAC-SHA256"); //指定签名的版本和算法，固定值为OSS4-HMAC-SHA256
messageMap.put("policy", stringToSign); //表单域
ObjectMapper objectMapper = new ObjectMapper();
return objectMapper.writeValueAsString(messageMap);
}
// 使用HMAC-SHA256算法计算给定密钥和数据的哈希值的静态方法
public static byte[] hmacsha256(byte[] key,String data){
try {
SecretKeySpec secretKeySpec = new SecretKeySpec(key, "HmacSHA256");
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(secretKeySpec);
byte[] hmacBytes = mac.doFinal(data.getBytes());
return hmacBytes;
}catch (Exception e){
throw new RuntimeException("Failed to calculate HMAC-SHA256", e);
}
}
}
访问接口示例。
package com.example.demo.controller;
import com.example.demo.util.GenerateSignature;
import com.fasterxml.jackson.core.JsonProcessingException;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class VxController {
@GetMapping("/generate_signature")
public String generate_signature() throws JsonProcessingException {
GenerateSignature generateSignature = new GenerateSignature();
return generateSignature.getSignature();
}
}
按钮，单击授予/收回RAM角色。
