node.js - Azure:按照文档完成后，使用 Azure REST API 的表 acl GET 不起作用

Question

我正在关注 GET ACL Table 的 Azure REST 文档, Authentication for the Azure Storage Services 。

下面是我正在执行的 REST 操作的代码片段。

//Input your Storage Account and access-key associated to it.
const yourStorageAccountName = '';
const accessKeyStorageAccount = '';
const Client = require('node-rest-client').Client;
const crypto = require("crypto");

async function getTableAcl() {
    let now = new Date();
    let nowUTC = now.toUTCString();
    let contentType = "application/json"
    // construct input value
    let stringToSign = `GET\n\n\n${nowUTC}\n/${yourStorageAccountName}/tablename\ncomp:acl`;
    let accesskey = accessKeyStorageAccount;
    // create base64 encoded signature
    let key = new Buffer(accesskey, "base64");
    let hmac = crypto.createHmac("sha256", key);
    hmac.update(stringToSign);
    let sig = hmac.digest("base64");
    console.log("SIGNATURE : " + sig);
    console.log("nowutc : " + nowUTC);
    let args = {
        headers: {
            "Authorization": "SharedKey " + yourStorageAccountName + ":" + sig,
            "Date": nowUTC,
            "x-ms-version": "2015-12-11"
        }
    };
    let restClient = new Client();
    restClient.get(`https://${yourStorageAccountName}.table.core.windows.net/tablename?comp=acl`, args, function (data, response) {
        console.log(JSON.stringify(data));
        //console.log(response);
    });
}

getTableAcl()

这里的问题是 Azure Table ACL documentation 中没有提及 Content-Type但在授权 header 部分中，它被赋予包含内容类型。因此，我将“stringToSign”中的内容类型保留为空，并且不在 REST 调用中提供内容类型 header 。我可能遗漏了一些东西，但我无法确定它可能是什么。

如果我在这种情况下遗漏了什么，你能告诉我吗？

Answer 1

基本上，问题在于您正在正确生成规范化资源字符串。

文档说明如下:

2009-09-19 and later Shared Key Lite and Table service format

This format supports Shared Key and Shared Key Lite for all versionsof the Table service, and Shared Key Lite for version 2009-09-19 andlater of the Blob and Queue services and version 2014-02-14 and laterof the File service. This format is identical to that used withprevious versions of the storage services. Construct theCanonicalizedResource string in this format as follows:

1. Beginning with an empty string (""), append a forward slash (/), followed by the name of the account that owns the resource beingaccessed.
2. Append the resource's encoded URI path. If the request URI addresses a component of the resource, append the appropriate querystring. The query string should include the question mark and the compparameter (for example, ?comp=metadata). No other parameters should beincluded on the query string.

基于此，您的 stringToSign 应该是:

let stringToSign = `GET\n\n\n${nowUTC}\n/${yourStorageAccountName}/tablename?comp=acl`;

尝试一下，应该有效。