确保 Authorization 标头的值正确形成，包括签名

Question

使用 Azure Storage API 访问文件服务时，我们收到以下错误。

<?xml version="1.0" encoding="utf-8"?>
<Error>
  <Code>AuthenticationFailed</Code>
  <Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:5a7f5ef2-a01a-0023-134e-436c77000000 Time:2021-05-07T14:36:32.7067133Z</Message>
  <AuthenticationErrorDetail>Unversioned authenticated access is not allowed.</AuthenticationErrorDetail>
</Error>

我们遵循了文档并相信我们拥有所有正确的标题，但显然缺少一些东西。

我们正在编码的签名字符串：

GET\n\n\n\n\n\n\n\n\n\n\n\nx-ms-date:Fri, 07 May 2021 15:29:49 GMT\nx-ms-version:2020-04-08\n/*our_azure_resource*\ncomp:metadata

使用我们用来进行编码的 CryptoJS 的代码

let signature = CryptoJS.HmacSHA256(CryptoJS.enc.Utf8.parse(stringToSign).toString(), this.key)
                        .toString(CryptoJS.enc.Base64);

授权标头的值：

SharedKey storageaccountname:decodedstring

Answer 1

根据我的测试，我们需要使用以下代码对包crypto-js进行签名

const str = CryptoJS.HmacSHA256(
  inputvalue,
  CryptoJS.enc.Base64.parse(accountKey)
);
const sig = CryptoJS.enc.Base64.stringify(str);

例如

1. 安装包

npm i crypto-js request xml2js

1. 代码（列出容器）

var CryptoJS = require("crypto-js");
var request = require("request");
var parseString = require("xml2js").parseString;
const methodName = "GET";
const accountName = "andyprivate";
const accountKey =
  "";

const date = new Date().toUTCString();
const version = "2020-04-08";

const inputvalue =
  methodName +
  "\n" /*VERB*/ +
  "\n" /*Content-Encoding*/ +
  "\n" /*Content-Language*/ +
  "\n" /*Content-Length*/ +
  "\n" /*Content-MD5*/ +
  "\n" /*Content-Type*/ +
  "\n" /*Date*/ +
  "\n" /*If-Modified-Since*/ +
  "\n" /*If-Match*/ +
  "\n" /*If-None-Match*/ +
  "\n" /*If-Unmodified-Since*/ +
  "\n" /*Range*/ +
  "x-ms-date:" +
  date +
  "\n" +
  "x-ms-version:" +
  version +
  "\n" +
  "/" +
  accountName +
  "/" +
  "\ncomp:list";
console.log(inputvalue);
const str = CryptoJS.HmacSHA256(
  inputvalue,
  CryptoJS.enc.Base64.parse(accountKey)
);
const sig = CryptoJS.enc.Base64.stringify(str);

const options = {
  method: "GET",
  url: `https://${accountName}.blob.core.windows.net/?comp=list`,
  headers: {
    "x-ms-date": date,
    "x-ms-version": version,
    Authorization: "SharedKey " + accountName + ":" + sig,
  },
};
request(options, function (error, response) {
  if (error) throw new Error(error);
  parseString(response.body, (error, result) => {
    if (error) throw new Error(error);
    const res = JSON.stringify(result);
    console.log(res);
  });
});

更多详情请参考here。