如何翻译 AWS Task 1: Create a Canonical Request for Signature Version 4

Question

(免责声明：这是一个 "How-to"，因为我在实施 AWS 签名版本 4 时找不到任何 CF 示例)

如何在 CF 中实现 Task 1: Create a Canonical Request for Signature Version 4？

总结：

以 HTTP 请求方法（GET、PUT、POST 等）开头，然后是换行符。
添加规范 URI 参数，后跟换行符。
添加规范查询字符串，后跟换行符
添加规范 headers，后跟换行符。
添加签名 headers，后跟换行符。
使用像 SHA256 这样的散列（摘要）函数从请求 body 中的有效负载创建散列值
通过将每个步骤中的组件组合为一个字符串来构造完成的规范请求。
使用用于散列负载的相同算法创建规范请求的摘要（散列）。

Answer 1

下面是Task 1: Create a Canonical Request for Signature Version 4

的cfscript实现

结果：

f536975d06c0309214f805bb90ccff089219ecd68b2577efef23edd43b7e1a59

代码：

从HTTP请求方式开始（GET、PUT、POST等）

requestMethod = "GET";
writeOutput("<br>requestMethod: <code>"& requestMethod &"</code>");

添加（编码的）规范 URI 参数，后跟换行符。

originalURI = "";
// If the absolute path is empty, use a forward slash (/)
originalURI  = len(trim(originalURI)) ? originalURI : "/"& originalURI;
// Encode URI and preserve forward slashes 
canonicalURI = replace( encodeRFC3986( originalURI ), "%2F", "/", "all");
writeOutput("<br>canonicalURI: <code>"& canonicalURI &"</code>");

添加规范查询字符串，后跟换行符

queryParams = { "Action"="ListUsers", "Version"="2010-05-08" };

// a) Encode parameter names and values 
encodedParams = {};
structEach( queryParams, function(key, value) {
    encodedParams[ encodeRFC3986(arguments.key) ] = encodeRFC3986( arguments.value);
});

// b) Sort the encoded parameter in ascending order (ASCII order)
encodedKeyNames = structKeyArray( encodedParams );
arraySort( encodedKeyNames, "text" );

// c) Build the canonical query string. Starting with first parameter, append encoded 
// parameter name, followed by character '=' (ASCII code 61), followed by the encoded value
encodedPairs  = [];
for (key in encodedKeyNames) {
    arrayAppend( encodedPairs, key &"="& encodedParams[ key ] ); 
}
// d) Append the character '&' (ASCII code 38) after each parameter value, except for the last value in the list. 
canonicalQueryString = arrayToList( encodedPairs, "&");
writeOutput("<br>canonicalQueryString: <code>"& canonicalQueryString &"</code>");

添加规范 headers，后跟一个换行符。

requestHeaders = { "Content-type"= "application/x-www-form-urlencoded; charset=utf-8"
                    , "Host" = "iam.amazonaws.com"
                    , "X-Amz-Date" = "20150830T123600Z"
                };

// a) Convert all header names to lowercase and remove leading spaces and trailing spaces. 
// Convert sequential spaces in the header value to a single space.         
cleanedHeaders = {};
structEach( requestHeaders, function(key, value) {
    headerName = reReplace( trim(arguments.key), "\s+", " ", "all");
    headerValue = reReplace( trim(arguments.value), "\s+", " ", "all");
    cleanedHeaders[ lcase(headerName) ] = headerValue;
});

// b) [sort] the (lowercase) headers by character code
sortedHeaderNames = structKeyArray( cleanedHeaders );
arraySort( sortedHeaderNames, "text" );

// c) Append the lowercase header name followed by a colon.
// Do not sort the values in headers that have multiple values.
cleanedPairs  = [];
for (key in sortedHeaderNames) {
    arrayAppend( cleanedPairs, key &":"& cleanedHeaders[ key ] ); 
}

// d) Append new line after each header pair. Should END WITH a new line
canonicalHeaderString = arrayToList( cleanedPairs, chr(10) ) & chr(10) ;
writeOutput("<br> canonicalHeaderString: <code>"& canonicalHeaderString &"</code>");

添加带符号的headers，后跟一个换行符

// To create the signed headers list, convert all header names to lowercase, 
// sort them by character code, and use a semicolon to separate the header names. 
// Note, we already have the sorted names from the canonical header logic (step 4)
signedHeaderString = arrayToList( sortedHeaderNames, ";" );
writeOutput("<br>signedHeaderString: <code>"& signedHeaderString &"</code>");

在 http/https 请求的 body 中创建有效负载的散列

requestPayload = "";
payloadChecksum = lcase( hash( requestPayload , "SHA256" ) );
writeOutput("<br>payloadChecksum: <code>"& payloadChecksum &"</code>");

构造规范请求，将每个步骤的组件组合为一个字符串

canonicalRequest = requestMethod & chr(10)
                    & canonicalURI & chr(10)
                    & canonicalQueryString & chr(10)
                    & canonicalHeaderString & chr(10)
                    & signedHeaderString & chr(10)
                    & payloadChecksum ;

writeOutput("<br>canonicalRequest: <pre>"& canonicalRequest &"</pre>");

使用用于散列有效负载的相同算法创建规范请求的摘要（散列）

requestDigest = lcase( hash( canonicalRequest , "SHA256" ) );
writeOutput("<br>requestDigest: <code>"& requestDigest &"</code>");

UDF 编码RFC3986:

    /**
    * URI encoding per RFC 3986:
    *  <ul>
    *     <li>Unreserved characters that should not be escaped: ALPHA / DIGIT / "-" / "." / "_" / "~" </li>
    *     <li>Spaces should be encoded as %20 instead of +</li>
    *     <li>Reserved characters that should be escaped include:   ? ## [ ] @ ! $ & ' ( ) * + , ; =</li>
    *  </ul>
    *  
    * @text String to encode
    * @returns URI encoded text
    */
    public function encodeRFC3986(required string text) {
        // Requires CF10+
        Local.encoded = encodeForURL(arguments.text);

        // Undo encoding of tilde "~"
        Local.encoded = replace( Local.encoded, "%7E", "~", "all" );
        // Change space encoding from "+" to "%20"
        Local.encoded = replace( Local.encoded, "+", "%20", "all" );
        // URL encode asterisk "*" 
        Local.encoded = replace( Local.encoded, "*", "%2A", "all" );

        return Local.encoded;
    }

如何翻译 AWS Task 1: Create a Canonical Request for Signature Version 4

How to translate AWS Task 1: Create a Canonical Request for Signature Version 4

coldfusion

amazon-web-services

coldfusion-11