DocsICP FilingConsole
官方文档
首页

Signature mechanism

更新时间：
复制 MD 格式
我的收藏

To ensure the security of API calls, Alibaba Cloud uses a signature to verify the identity of each API requester. You must include signature information in all requests, regardless of whether you use the HTTP or HTTPS protocol.

Overview

For RPC APIs, add a signature to the query of the API request in the following format.

https://Endpoint/?SignatureVersion=1.0&SignatureMethod=HMAC-SHA1&Signature=CT9X0VtwR86fNWSnsc6v8YGOjuE%3D&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf
The parameters are:
  • SignatureMethod: The signature method. Only HMAC-SHA1 is supported.
  • SignatureVersion: The version of the signature algorithm. The value must be 1.0.
  • SignatureNonce: A unique random number that is used to prevent replay attacks. You must specify a different random number for each request. We recommend that you use a universally unique identifier (UUID).
  • Signature: The signature that is generated using your AccessKey secret to symmetrically encrypt the request.
The signature algorithm complies with the RFC 2104 HMAC-SHA1 specification. The algorithm calculates the HMAC value of the encoded and sorted request string using your AccessKey secret. This HMAC value is the signature. The signature is generated based on the parameters of the request. Because the content of each API request is different, a unique signature is generated for each request. Follow the steps described in this topic to calculate the signature value. 
Signature = Base64( HMAC-SHA1( AccessSecret, UTF-8-Encoding-Of(
StringToSign)) )

Step 1: Construct the string to sign

  1. Construct a canonicalized query string from the request parameters.
    1. Sort all request parameters alphabetically by parameter name. The parameters to be sorted include all common and API-specific request parameters except the `Signature` parameter.
      Note If you submit a request using the GET method, these parameters are the part of the request URI that follows the question mark (?) and are separated by ampersands (&).
    2. URL-encode the names and values of the sorted request parameters based on the UTF-8 character set. For more information about the encoding rules, see the following table.
      Character Encoding method
      A-Z, a-z, 0-9, and the characters -, _, ., ~ Do not encode.
      Other characters Encode into the %XY format. XY is the hexadecimal representation of the character's ASCII code. For example, a double quotation mark (") is encoded as %22.
      Extended UTF-8 characters Encode into the %XY%ZA… format.
      Space Encode as %20 instead of a plus sign (+).
      This encoding method differs from the standard application/x-www-form-urlencoded Multipurpose Internet Mail Extensions (MIME) format. An example of the standard format is the java.net.URLEncoder implementation in the Java standard library. To get the required encoded string, first encode the string using a standard library. Then, replace plus signs (+) with %20, asterisks (*) with %2A, and %7E with tildes (~). The following percentEncode method implements this algorithm: 
      private static final String ENCODING = "UTF-8";
private static String percentEncode(String value) throws UnsupportedEncodingException 
{
return value != null ? URLEncoder.encode(value, ENCODING).replace("+", "%20").replace("*", "%2A").replace("%7E", "~") : null;
}
    3. Connect the encoded parameter name and its value with an equal sign (=).
    4. Connect the resulting parameter-value pairs with ampersands (&) in the same order that is used in the sorting step. The resulting string is the canonicalized query string.
  2. Construct the string-to-sign from the canonicalized query string that you constructed in the preceding step. The string-to-sign must be in the following format: 
    StringToSign=
      HTTPMethod + "&" +
      percentEncode("/") + "&" +
       percentEncode(CanonicalizedQueryString)

    Where:

    • HTTPMethod is the HTTP method that is used to submit the request, such as GET.
    • percentEncode("/") is the value that is obtained after you URL-encode the forward slash (/) character based on the rules described in Step 1.b. The value is %2F.
    • percentEncode(CanonicalizedQueryString) is the string that is obtained after you URL-encode the canonicalized query string that you constructed in Step 1.a. Use the encoding rules that are described in Step 1.b.

Step 2: Calculate the signature value

  1. Calculate the HMAC value of the string-to-sign (StringToSign) as defined in RFC 2104.
    Note The key that is used for the signature calculation is your AccessKey secret followed by an ampersand (&) character (ASCII 38). The hash algorithm is SHA1.
  2. Encode the HMAC value as a string based on Base64 encoding rules. The resulting string is the signature value (Signature).
  3. Add the signature value to the request parameters as the value of the Signature parameter.
    Note If you add the signature value as the final request parameter, you must URL-encode the signature value together with other parameters based on the rules that are defined in RFC 3986.

Example

This section uses the DescribeRegions API operation as an example. Assume that the AccessKey Id is testid and the AccessKey Secret is testsecret. The request URL before a signature is added is as follows:

http://baasdis.cn-hangzhou.aliyuncs.com/?Timestamp=2020-06-23T11%3A19%3A12Z&Format=JSON&AccessKeyId=testid&Action=CreatePersonalDID&Version=2020-05-09

If you use testsecret& as the key, the calculated signature value is:

OLeaidS1JvxuMvnyHOwuJ+uX5qY=

Add the signature to the request URL as the value of the Signature parameter. The final request URL is:

http://baasdis.cn-hangzhou.aliyuncs.com/?Timestamp=2020-06-23T11%3A19%3A12Z&Format=JSON&AccessKeyId=testid&Action=CreatePersonalDID&SignatureVersion=1.0&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf&Version=2020-05-09&Signature=OLeaidS1JvxuMvnyHOwuJ+uX5qY=&SignatureMethod=HMAC-SHA1
Previous：How to call APIsNext：Common parameters