node.js - aws elasticsearch 在发布请求时出现签名错误

Question

使用以下提取函数时出现 403 签名错误:

    function elasticsearchFetch(AWS, elasticsearchDomain, endpointPath, options = {}, region = process.env.AWS_REGION) {
  return new Promise((resolve, reject) => {
    const { body, method = 'GET' } = options;
    const endpoint = new AWS.Endpoint(elasticsearchDomain);
    const request = new AWS.HttpRequest(endpoint, region);
    request.method = method;
    request.path += endpointPath;
    request.headers.host = elasticsearchDomain;
    if (body) {
      request.body = body;
      request.headers['Content-Type'] = 'application/json';
      request.headers['Content-Length'] = request.body.length;
    }
    const credentials = new AWS.EnvironmentCredentials('AWS');
    const signer = new AWS.Signers.V4(request, 'es');
    signer.addAuthorization(credentials, new Date());
    const client = new AWS.HttpClient();
    client.handleRequest(request, null, (res) => {
      let chunks = '';
      res.on('data', (chunk) => {
        chunks += chunk;
      });
      res.on('end', () => {
        if (res.statusCode !== 201) console.log('Got these options STATUSCODE', JSON.stringify(options, false, 2));
        return resolve({ statusCode: res.statusCode, body: chunks });
      });
    }, (error) => {
      console.log('Got these options ERROR', JSON.stringify(options, false, 2));
      return reject(error);
    });
  });
}

这是上述函数中用于请求的选项:

{
    "method": "POST",
    "body": "{\"prefix\":\"image_233/ArtService/articles-0/GB/ART-60297885/\",\"id\":\"ART-60297885\",\"retailUnit\":\"GB\",\"commercial\":{\"name\":{\"en-GB\":\"FÖRBÄTTRA\"}},\"schemaType\":\"product\",\"productType\":\"ART\"}"
}

并收到此错误:

{
    "statusCode": 403,
    "body": "{\"message\":\"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\"}"
}

这是端点:233/_doc/

Answer 1

我相信您的 Content-Length header 不正确，导致签名不匹配。

• 您的负载包含字符串 FÖRBÄTTRA，它有两个双字节字符。
• 您将 Content-Length 设置为 request.body.length，即 186。
• 虽然此是正文中的字符数，但它不是正文中的字节数 (188)。

<小时/>

要计算Content-Length，请使用Buffer.byteLength(request.body)。对于这样的 POST 请求，您甚至可以完全删除该行代码，请求就会成功。

  // Content-Length is only needed for DELETE requests that include a request
  // body, but including it for all requests doesn't seem to hurt anything.
  request.headers['Content-Length'] = Buffer.byteLength(request.body);

来源:https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-request-signing.html#es-request-signing-node