azure - 确保授权 header 的值格式正确，包括签名

Question

使用 Azure 存储 API 访问文件服务时，我们收到以下错误。

<?xml version="1.0" encoding="utf-8"?>
<Error>
  <Code>AuthenticationFailed</Code>
  <Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:5a7f5ef2-a01a-0023-134e-436c77000000 Time:2021-05-07T14:36:32.7067133Z</Message>
  <AuthenticationErrorDetail>Unversioned authenticated access is not allowed.</AuthenticationErrorDetail>
</Error>

我们已遵循文档，并相信我们拥有所有正确的 header ，但显然缺少一些内容。

我们正在编码的签名字符串:

GET\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:Fri, 07 May 2021 15:29:49 GMT\nx-ms-version:2020-04-08\n/*our_azure_resource*\ncomp:metadata

使用我们用来进行编码的 CryptoJS 的代码

let signature = CryptoJS.HmacSHA256(CryptoJS.enc.Utf8.parse(stringToSign).toString(), this.key)
                        .toString(CryptoJS.enc.Base64);

授权 header 的值:

SharedKey storageaccountname:decodedstring

Answer 1

根据我的测试，我们需要使用以下代码来对crypto-js包进行签名

const str = CryptoJS.HmacSHA256(
  inputvalue,
  CryptoJS.enc.Base64.parse(accountKey)
);
const sig = CryptoJS.enc.Base64.stringify(str);

例如

1. 安装包

npm i crypto-js request xml2js

代码(列出容器)

var CryptoJS = require("crypto-js");
var request = require("request");
var parseString = require("xml2js").parseString;
const methodName = "GET";
const accountName = "andyprivate";
const accountKey =
  "";

const date = new Date().toUTCString();
const version = "2020-04-08";

const inputvalue =
  methodName +
  "\n" /*VERB*/ +
  "\n" /*Content-Encoding*/ +
  "\n" /*Content-Language*/ +
  "\n" /*Content-Length*/ +
  "\n" /*Content-MD5*/ +
  "\n" /*Content-Type*/ +
  "\n" /*Date*/ +
  "\n" /*If-Modified-Since*/ +
  "\n" /*If-Match*/ +
  "\n" /*If-None-Match*/ +
  "\n" /*If-Unmodified-Since*/ +
  "\n" /*Range*/ +
  "x-ms-date:" +
  date +
  "\n" +
  "x-ms-version:" +
  version +
  "\n" +
  "/" +
  accountName +
  "/" +
  "\ncomp:list";
console.log(inputvalue);
const str = CryptoJS.HmacSHA256(
  inputvalue,
  CryptoJS.enc.Base64.parse(accountKey)
);
const sig = CryptoJS.enc.Base64.stringify(str);

const options = {
  method: "GET",
  url: `https://${accountName}.blob.core.windows.net/?comp=list`,
  headers: {
    "x-ms-date": date,
    "x-ms-version": version,
    Authorization: "SharedKey " + accountName + ":" + sig,
  },
};
request(options, function (error, response) {
  if (error) throw new Error(error);
  parseString(response.body, (error, result) => {
    if (error) throw new Error(error);
    const res = JSON.stringify(result);
    console.log(res);
  });
});

更多详情请引用here .