Signature mechanism

更新时间:
复制 MD 格式

Alibaba Cloud uses a signature to authenticate each API request and ensure security. All requests must include a signature, regardless of whether you use the HTTP or HTTPS protocol.

Overview

For RPC APIs, you must add the signature parameters to the query string of the API request.

https://Endpoint/?SignatureVersion=1.0&SignatureMethod=HMAC-SHA1&Signature=CT9X0VtwR86fNWSnsc6v8YGOjuE%3D&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf
The parameters are described as follows:
  • SignatureMethod: The signature method. Only HMAC-SHA1 is supported.
  • SignatureVersion: The version of the signature algorithm. The current version is 1.0.
  • SignatureNonce: A unique random number used to prevent replay attacks. You must use a different random number for each request. We recommend that you use a universally unique identifier (UUID).
  • Signature: The signature that is generated from the request using your AccessKey secret.

Calculate a signature

The signature algorithm complies with the RFC 2104 HMAC-SHA1 specification. To create a signature, you must calculate the HMAC value of the string to sign using your AccessKey secret. The string to sign is created from the encoded and sorted request parameters. The signature is unique for each request because it is based on the request parameters.

Signature = Base64( HMAC-SHA1( AccessSecret, UTF-8-Encoding-Of(StringToSign)) )
Follow these steps to calculate the signature:
  1. Create the string to sign.
    1. Create a canonicalized query string from the request parameters.
      1. Sort all request parameters alphabetically by name. This includes common request parameters and operation-specific parameters, but excludes the Signature parameter.

        For GET requests, these parameters are the part of the request URI that follows the question mark (?) and are separated by ampersands (&).

      2. URL-encode the name and value of each sorted request parameter in UTF-8. The encoding rules are as follows:
        Character Encoding method
        A-Z, a-z, 0-9, and the characters -, _, ., ~ Do not encode.
        Other characters Encode as %XY, where XY is the hexadecimal representation of the character's ASCII code. For example, a double quotation mark (") is encoded as %22.
        Extended UTF-8 characters Encode as %XY%ZA….
        A space Encode as %20 instead of a plus sign (+).
        This encoding method differs from the standard application/x-www-form-urlencoded Multipurpose Internet Mail Extensions (MIME) format, such as the java.net.URLEncoder implementation in the Java standard library. To produce the correct encoding, first encode the string with a standard library. Then, replace plus signs (+) with %20, asterisks (*) with %2A, and %7E with tildes (~). The following percentEncode method shows this implementation:
        private static final String ENCODING = "UTF-8";
        private static String percentEncode(String value) throws UnsupportedEncodingException 
        {
        return value != null ? URLEncoder.encode(value, ENCODING).replace("+", "%20").replace("*", "%2A").replace("%7E", "~") : null;
        }
      3. Join the encoded parameter name and value with an equal sign (=).
      4. Join the resulting parameter strings with ampersands (&) in the same alphabetical order as in Step 1.a.i. This creates the canonicalized query string.
    2. Use the canonicalized query string from the previous step to create the string to sign in the following format:
      StringToSign=
            HTTPMethod + “&” +
            percentEncode(“/”) + ”&” +
            percentEncode(CanonicalizedQueryString)

      Where:

      • HTTPMethod is the HTTP method used for the request, such as GET.
      • percentEncode("/") is the forward slash character (/) encoded according to the URL encoding rules in Step 1.a.ii. The encoded value is %2F.
      • percentEncode(CanonicalizedQueryString) is the canonicalized query string from Step 1.a, encoded according to the URL encoding rules in Step 1.a.ii.
  2. Calculate the signature.
    1. Calculate the HMAC value of the string to sign (StringToSign) as specified in RFC 2104.
      Note The key used for the signature calculation is your AccessKey secret with an ampersand (&) character (ASCII 38) appended. The hash algorithm is SHA1.
    2. Encode the HMAC value in Base64 to obtain the signature string (Signature).
    3. Add the resulting signature value to the request parameters as the Signature parameter.
      Note The signature value must be URL-encoded according to RFC3986 before it is added to the request parameters.

Example

This example uses the GetPredictResult API. Assume that the AccessKey ID is testid and the AccessKey secret is testsecret. The request URL before signing is as follows:

http://nlp-automl.cn-hangzhou.aliyuncs.com/?Timestamp=2016-02-23T12:46:24Z&Format=XML&AccessKeyId=testid&Action=GetPredictResult&SignatureMethod=HMAC-SHA1&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf&Version=2019-11-11&SignatureVersion=1.0

The signature value calculated using testsecret is as follows:

OLeaidS1JvxuMvnyHOwuJ+uX5qY=

Add the signature to the request as the Signature parameter. The final URL is as follows:

http://nlp-automl.cn-hangzhou.aliyuncs.com/?SignatureVersion=1.0&Action=GetPredictResult&Format=XML&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf&Version=2019-11-11&AccessKeyId=testid&Signature=OLeaidS1JvxuMvnyHOwuJ+uX5qY=&SignatureMethod=HMAC-SHA1&Timestamp=2016-02-23T12%3A46%3A24Z