如何使用AWS签名4 -> API网关-> Lambda进行授权

Question

我在谷歌上搜索了很多，却没有找到解决问题的方法。我已经阅读了AWS签名4的整个身份验证过程，并遵循了他们的教程以及查看其他来源。我正在尝试对向API网关发出请求的桌面应用程序进行客户端身份验证。

当我使用邮递员时，它正常工作，但我尝试在Nodejs中生成我自己的签名，但没有结果，我一直从调用.中得到403条消息。

下面的函数返回经过身份验证的requestUrl，然后由axios.get(requestUrl)运行。当我使用邮递员生成的请求时，它工作得非常好，但是，一旦我使用生成的请求，我就会遇到问题。我在鉴定的时候遗漏了什么吗？下面是我的代码当前的样子：

function Authorize() {
  const host = "EXAMPLE.execute-api.us-east-1.amazonaws.com"
  const reg = 'us-east-1'
  const meth = 'GET'
  const serv = 'execute-api'
  const endpoint = '/development/putImage'
  // Keys
  let access = "EXAMPLE"
  let key = "KEY"
  
  // Get Date
  let t = new Date();
  let amzDate = t.toJSON().replace(/[-:]/g, "").replace(/\.[0-9]*/, "");
  let dateStamp = t.toJSON().replace(/-/g, "").replace(/T.*/, "");

  // ************* TASK 1: CREATE CANONICAL REQUEST *************
  // Create Canonical Request
  let canonical_uri=endpoint
  let canonical_headers="host: "+host+"\n"

  let signedHeaders = 'host'
    
  let algorithm = 'AWS4-HMAC-SHA256'
  let credentialScope = dateStamp + "/" + reg + "/" + serv + "/" + "aws4_request"

  // Set query string
  let canonicalQueryString = ""
  canonicalQueryString += "X-Amz-Date=" + amzDate
  canonicalQueryString += "&X-Amz-Algorithm=" + algorithm;
  canonicalQueryString += "&X-Amz-Credential=" + encodeURIComponent(access + "/" + credentialScope)
  canonicalQueryString += "&X-Amz-SignedHeaders=" + signedHeaders
  
  // Empty payload for get request
  var payloadHash = crypto.createHash('sha256').update('').digest('hex');
  
  // Set canonical request
  var canonicalRequest = meth + "\n" + canonical_uri + "\n" + canonicalQueryString + "\n" + canonical_headers + "\n" + signedHeaders + "\n" + payloadHash
  console.log(canonicalRequest)

  // ************* TASK 2: CREATE THE STRING TO SIGN*************
  let stringToSign = algorithm + '\n' + amzDate + '\n' + credentialScope + '\n' + crypto.createHash('sha256').update(canonicalRequest).digest('hex');

  // ************* TASK 3: CALCULATE THE SIGNATURE *************
  var signingKey = getSignatureKey(key, dateStamp, reg, serv)
  var signature = crypto.createHmac('sha256', signingKey).update(stringToSign).digest('hex');
  
  // ************* TASK 4: ADD SIGNING INFORMATION TO THE REQUEST *************
  canonicalQueryString += '&X-Amz-Signature=' + signature
  let requestUrl = "https://"+host+ endpoint + "?" + canonicalQueryString
 
  console.log(requestUrl)
  
  return requestUrl
}

Answer 1

下面的代码对我很有用。欲了解更多信息，请访问https://docs.aws.amazon.com/opensearch-service/latest/developerguide/request-signing.html#request-signing-node

const { HttpRequest} = require("@aws-sdk/protocol-http");
const { defaultProvider } = require("@aws-sdk/credential-provider-node");
const { SignatureV4 } = require("@aws-sdk/signature-v4");
const { NodeHttpHandler } = require("@aws-sdk/node-http-handler");
const { Sha256 } = require("@aws-crypto/sha256-browser");

...

var request = new HttpRequest({
        body: JSON.stringify({"users":["G0000000B","G0000000A"]}),
        headers: {
            'Content-Type': 'application/json',
            'apiKey':'XXXXXXXXXXXX',
            'apiSecret': 'XXXXXXXXXXXXXXXXXX',
            'host': 'service2.xxx.xxx.xx'
        },
        hostname: 'service2.xxx.xxx.xx',
        method: 'POST',
        path: 'API/user/list'
    });
    
    var signer = new SignatureV4({
        credentials: defaultProvider(),
        region: 'ap-southeast-1',
        service: 'execute-api',
        sha256: Sha256
    });

    const signedRequest = await signer.sign(request);
    
    // Send the request
    var client = new NodeHttpHandler();
    var { response } =  await client.handle(signedRequest)
    console.log(response.statusCode + ' ' + response.body.statusMessage);
    var responseBody = '';
    await new Promise(() => {
      response.body.on('data', (chunk) => {
        responseBody += chunk;
      });
      response.body.on('end', () => {
        console.log('Response body: ' + responseBody);
      });
    }).catch((error) => {
        console.log('Error: ' + error);
    });