Object Storage Service:A V4 signature in a PostObject request

Signature in a PostObject request

To enhance data security, the PostObject request integrates the V4 signature algorithm. The form elements and policy form field play a key role in ensuring the validity and security of PostObject requests.

<AccessKeyId>/<date>/<region>/oss/aliyun_v4_request

{
  "expiration": "2023-12-03T13:00:00.000Z",
  "conditions": [
    {"bucket": "examplebucket"},
    {"x-oss-signature-version": "OSS4-HMAC-SHA256"},
    {"x-oss-credential": "AKIDEXAMPLE/20231203/cn-hangzhou/oss/aliyun_v4_request"},
    {"x-oss-security-token": "CAIS******"},
    {"x-oss-date": "20231203T121212Z"},
    ["content-length-range", 1, 10],
    ["eq", "$success_action_status", "201"],
    ["starts-with", "$key", "user/eric/"],
    ["in", "$content-type", ["image/jpg", "image/png"]],
    ["not-in", "$cache-control", ["no-cache"]]
  ]
}

Signature calculation process

1. Create a UTF-8 encoded policy.

2. Create a string to sign.

   Base64-encode the policy to generate a string that can be transmitted securely as the string to sign.

3. Calculate the signing key.

   Encrypt the string to sign by using HMAC-SHA256. Use the derived keys of the account as the keys for using HMAC-SHA256.

4. Calculate the signature.

   Convert the binary hash calculated by using HMAC-SHA256 to a hexadecimal string. The obtained hexadecimal string is the signature used to verify the integrity and validity of the request.

Examples

1. The following sample code provides an example on how to use the preceding policy to calculate a V4 signature for a PostObject request by using OSS SDK for Java:

   Use Access Key (AK) or Secret Key (SK)

   import com.aliyun.oss.common.utils.BinaryUtil;
   import org.apache.commons.codec.binary.Base64;
   import javax.crypto.Mac;
   import javax.crypto.spec.SecretKeySpec;
   
   public class Demo {
       public static void main(String[] args) throws Exception {
           // Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured.
           String accesskeyid =  System.getenv().get("OSS_ACCESS_KEY_ID");
           String accesskeysecret =  System.getenv().get("OSS_ACCESS_KEY_SECRET");
   
           // Step 1: Create a policy.
           ObjectMapper mapper = new ObjectMapper();
   
           Map<String, Object> policy = new HashMap<>();
           policy.put("expiration", "2024-12-03T13:00:00.000Z");
   
           List<Object> conditions = new ArrayList<>();
   
           Map<String, String> bucketCondition = new HashMap<>();
           bucketCondition.put("bucket", "examplebucket");
           conditions.add(bucketCondition);
   
           Map<String, String> signatureVersionCondition = new HashMap<>();
           signatureVersionCondition.put("x-oss-signature-version", "OSS4-HMAC-SHA256");
           conditions.add(signatureVersionCondition);
   
           Map<String, String> credentialCondition = new HashMap<>();
           credentialCondition.put("x-oss-credential", "accesskeyid/20241203/cn-hangzhou/oss/aliyun_v4_request"); // Replace this variable with your AccessKey ID.
           conditions.add(credentialCondition);
   
           Map<String, String> dateCondition = new HashMap<>();
           dateCondition.put("x-oss-date", "20241203T121212Z");
           conditions.add(dateCondition);
   
           conditions.add(Arrays.asList("content-length-range", 1, 10));
           conditions.add(Arrays.asList("eq", "$success_action_status", "201"));
           conditions.add(Arrays.asList("starts-with", "$key", "user/eric/"));
           conditions.add(Arrays.asList("in", "$content-type", Arrays.asList("image/jpg", "image/png")));
           conditions.add(Arrays.asList("not-in", "$cache-control", Arrays.asList("no-cache")));
   
           policy.put("conditions", conditions);
   
           String jsonPolicy = mapper.writeValueAsString(policy);
           // Step 2: Create a string to sign.
           String stringToSign = new String(Base64.encodeBase64(jsonPolicy.getBytes()));
           System.out.println(stringToSign)
           
           // Step 3: Calculate the signing key.
           byte[] dateKey = hmacsha256(("aliyun_v4" + accesskeysecret).getBytes(), "20231203");
           byte[] dateRegionKey = hmacsha256(dateKey, "cn-hangzhou");
           byte[] dateRegionServiceKey = hmacsha256(dateRegionKey, "oss");
           byte[] signingKey = hmacsha256(dateRegionServiceKey, "aliyun_v4_request");
   
           // Step 4: Calculate the signature.
           byte[] result = hmacsha256(signingKey, stringToSign);
           String signature = BinaryUtil.toHex(result);
           System.out.println("signature:" + signature);
   
       }
   
       public static byte[] hmacsha256(byte[] key, String data) {
           try {
               // Initialize SecretKeySpec, set the algorithm to HMAC-SHA256, and use the provided key.
               SecretKeySpec secretKeySpec = new SecretKeySpec(key, "HmacSHA256");
   
               // Obtain a Mac instance and use the getInstance method to set the algorithm to HMAC-SHA256.
               Mac mac = Mac.getInstance("HmacSHA256");
               // Use the key to initialize the Mac instance.
               mac.init(secretKeySpec);
   
               // Calculate the HMAC value. Use the doFinal method to receive the data to be calculated and return the calculation result as an array.
               byte[] hmacBytes = mac.doFinal(data.getBytes());
   
               return hmacBytes;
           } catch (Exception e) {
               throw new RuntimeException("Failed to calculate HMAC-SHA256", e);
           }
       }
   }

   Sample response:

   signature:3908473f7dbfb79a102eaaa44ca1edec8d7058ce3bd1c624d59eb437463bd5d6

   Use temporary access credentials

   When calculating a signature for a PostObject request using temporary access credentials, you also need to obtain a security token by calling the AssumeRole operation of STS.

   import com.aliyun.oss.common.utils.BinaryUtil;
   import org.apache.commons.codec.binary.Base64;
   import javax.crypto.Mac;
   import javax.crypto.spec.SecretKeySpec;
   import com.aliyun.sts20150401.models.AssumeRoleResponse;
   import com.aliyun.sts20150401.models.AssumeRoleResponseBody;
   import com.aliyun.tea.TeaException;
   import com.fasterxml.jackson.databind.ObjectMapper;
   import java.util.*;
   public class Demo {
   
       // Initialize an STSClient instance.
       public static com.aliyun.sts20150401.Client createStsClient() throws Exception {
           com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config()
                   // Make sure that the OSS_ACCESS_KEY_ID environment variable is configured.
                   .setAccessKeyId(System.getenv("OSS_ACCESS_KEY_ID"))
                   // Make sure that the OSS_ACCESS_KEY_SECRET environment variable is configured.
                   .setAccessKeySecret(System.getenv("OSS_ACCESS_KEY_SECRET"));
           // Endpoint 
           config.endpoint = "sts.cn-hangzhou.aliyuncs.com";
           return new com.aliyun.sts20150401.Client(config);
       }
   
       // Obtain an STS token.
       public static AssumeRoleResponseBody.AssumeRoleResponseBodyCredentials getCredential() throws Exception {
           com.aliyun.sts20150401.Client client = Demo.createStsClient();
           com.aliyun.sts20150401.models.AssumeRoleRequest assumeRoleRequest = new com.aliyun.sts20150401.models.AssumeRoleRequest()
                   // Make sure that the OSS_STS_ROLE_ARN environment variable is configured.
                   .setRoleArn(System.getenv("OSS_STS_ROLE_ARN"))
                   .setRoleSessionName("role_session_name");// Specify a session name.
           com.aliyun.teautil.models.RuntimeOptions runtime = new com.aliyun.teautil.models.RuntimeOptions();
           try {
               // Write your own code to display the response of the API operation if necessary.
               AssumeRoleResponse response = client.assumeRoleWithOptions(assumeRoleRequest, runtime);
               // The AccessKey ID, AccessKey secret, and STS token that are required for subsequent operations are included in credentials.
               return response.body.credentials;
           } catch (TeaException error) {
               // Handle exceptions with caution in your actual business scenario and never ignore exceptions in your project. The error messages displayed in this example are for reference only.
               // The error message.
               System.out.println(error.getMessage());
               // The URL for troubleshooting.
               System.out.println(error.getData().get("Recommend"));
               com.aliyun.teautil.Common.assertAsString(error.message);
           } catch (Exception _error) {
               TeaException error = new TeaException(_error.getMessage(), _error);
               // Handle exceptions with caution in your actual business scenario and never ignore exceptions in your project. The error messages displayed in this example are for reference only.
               // The error message.
               System.out.println(error.getMessage());
               // The URL for troubleshooting.
               System.out.println(error.getData().get("Recommend"));
               com.aliyun.teautil.Common.assertAsString(error.message);
           }
           return null;
       }
   
       public static void main(String[] args) throws Exception {
   
           AssumeRoleResponseBody.AssumeRoleResponseBodyCredentials sts_data = getCredential();
           String accesskeyid = sts_data.accessKeyId;
           String accesskeysecret = sts_data.accessKeySecret;
           String securitytoken = sts_data.securityToken;
           // Step 1: Create a policy.
           ObjectMapper mapper = new ObjectMapper();
   
           Map<String, Object> policy = new HashMap<>();
           policy.put("expiration", "2024-12-03T13:00:00.000Z");
   
           List<Object> conditions = new ArrayList<>();
   
           Map<String, String> bucketCondition = new HashMap<>();
           bucketCondition.put("bucket", "examplebucket");
           conditions.add(bucketCondition);
   
           Map<String, String> signatureVersionCondition = new HashMap<>();
           signatureVersionCondition.put("x-oss-signature-version", "OSS4-HMAC-SHA256");
           conditions.add(signatureVersionCondition);
           
           Map<String, String> securityTokenCondition = new HashMap<>();
           securityTokenCondition.put("x-oss-security-token", securitytoken);
           conditions.add(securityTokenCondition);
           
           Map<String, String> credentialCondition = new HashMap<>();
           credentialCondition.put("x-oss-credential", "accesskeyid/20241203/cn-hangzhou/oss/aliyun_v4_request"); 
           conditions.add(credentialCondition);
   
           Map<String, String> dateCondition = new HashMap<>();
           dateCondition.put("x-oss-date", "20241203T121212Z");
           conditions.add(dateCondition);
   
           conditions.add(Arrays.asList("content-length-range", 1, 10));
           conditions.add(Arrays.asList("eq", "$success_action_status", "201"));
           conditions.add(Arrays.asList("starts-with", "$key", "user/eric/"));
           conditions.add(Arrays.asList("in", "$content-type", Arrays.asList("image/jpg", "image/png")));
           conditions.add(Arrays.asList("not-in", "$cache-control", Arrays.asList("no-cache")));
   
           policy.put("conditions", conditions);
   
           String jsonPolicy = mapper.writeValueAsString(policy);
           // Step 2: Create a string to sign.
           String stringToSign = new String(Base64.encodeBase64(jsonPolicy.getBytes()));
   
           // Step 3: Calculate the signing key.
           byte[] dateKey = hmacsha256(("aliyun_v4" + accesskeysecret).getBytes(), "20231203");
           byte[] dateRegionKey = hmacsha256(dateKey, "cn-hangzhou");
           byte[] dateRegionServiceKey = hmacsha256(dateRegionKey, "oss");
           byte[] signingKey = hmacsha256(dateRegionServiceKey, "aliyun_v4_request");
   
           // Step 4: Calculate the signature.
           byte[] result = hmacsha256(signingKey, stringToSign);
           String signature = BinaryUtil.toHex(result);
           System.out.println("signature:" + signature);
   
       }
   
       public static byte[] hmacsha256(byte[] key, String data) {
           try {
               // Initialize SecretKeySpec, set the algorithm to HMAC-SHA256, and use the provided key.
               SecretKeySpec secretKeySpec = new SecretKeySpec(key, "HmacSHA256");
   
               // Obtain a Mac instance and use the getInstance method to set the algorithm to HMAC-SHA256.
               Mac mac = Mac.getInstance("HmacSHA256");
               // Use the key to initialize the Mac instance.
               mac.init(secretKeySpec);
   
               // Calculate the HMAC value. Use the doFinal method to receive the data to be calculated and return the calculation result as an array.
               byte[] hmacBytes = mac.doFinal(data.getBytes());
   
               return hmacBytes;
           } catch (Exception e) {
               throw new RuntimeException("Failed to calculate HMAC-SHA256", e);
           }
       }
   }

   Sample response:

   signature:1e09438f7ad01af6b3e144b42c98929c68f8d090ce07f4c277b18d8b62d0aa02

2. The following sample code provides an example on how to calculate a V4 signature for a PostObject request by using OSS SDK for Python:

   import base64
   import hmac
   import hashlib
   import os
   
   def hmac_sha256(key, data):
       return hmac.new(key, data.encode('utf-8'), hashlib.sha256).digest()
   
   # Retrieve the AccessKey ID and AccessKey secret from environment variables.    
   accesskeyid = os.getenv('OSS_ACCESS_KEY_ID')
   accesskeysecret = os.getenv('OSS_ACCESS_KEY_SECRET')
   
   # Display the AccessKey ID.
   print(accesskeyid)
   
   # Check whether the environment variables are retrieved.
   if not accesskeyid or not accesskeysecret:
       raise ValueError("Required environment variables are not found: OSS_ACCESS_KEY_ID or OSS_ACCESS_KEY_SECRET")
   
   # Create a policy.
   policy = '''{
     "expiration": "2025-01-01T00:00:00.000Z",
     "conditions": [
       {"x-oss-signature-version": "OSS4-HMAC-SHA256"},
       {"x-oss-credential": "accesskeyid/20241105/cn-hangzhou/oss/aliyun_v4_request"}, // Replace accesskeyid with your actual access key ID.
       {"x-oss-date": "20241105T065000Z"}
     ]
   }'''
   
   # Output the policy.
   print(policy)
   
   # Calculate the string to sign.
   string_to_sign = base64.b64encode(policy.encode('utf-8')).decode('utf-8')
   print(string_to_sign)
   
   # Calculate the signing key.
   date_key = hmac_sha256(f"aliyun_v4{accesskeysecret}".encode('utf-8'), "20241105")
   date_region_key = hmac_sha256(date_key, "cn-beijing")
   date_region_service_key = hmac_sha256(date_region_key, "oss")
   signing_key = hmac_sha256(date_region_service_key, "aliyun_v4_request")
   
   # Calculate the signature.
   result = hmac_sha256(signing_key, string_to_sign)
   signature = result.hex()
   print("signature:", signature)

   Sample response:

   signature:9e85d56429245283b1aca5bc2dc31e0020b95ac2de9e9b81b496994db602ba1e