通过CognitoSync服务使用aws-sdk-js时的InvalidSignatureException

Question

我在我的web应用程序中使用最新版本的aws-sdk-js (v2.471.0)。

通过Cognito身份成功地对用户进行了身份验证，并为其提供了一个有效会话。我的问题是所有CognitoSync调用都会失败，并显示相同的错误消息：

InvalidSignatureException: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.
    at Object.extractError (http://localhost:4400/scripts/libs/aws-sdk.js:166311:27)
    at Request.extractError (http://localhost:4400/scripts/libs/aws-sdk.js:166652:8)
    at Request.callListeners (http://localhost:4400/scripts/libs/aws-sdk.js:169314:20)
    at Request.emit (http://localhost:4400/scripts/libs/aws-sdk.js:169286:10)
    at Request.emit (http://localhost:4400/scripts/libs/aws-sdk.js:167947:14)
    at Request.transition (http://localhost:4400/scripts/libs/aws-sdk.js:167286:10)
    at AcceptorStateMachine.runTo (http://localhost:4400/scripts/libs/aws-sdk.js:172800:12)
    at http://localhost:4400/scripts/libs/aws-sdk.js:172812:10
    at Request.<anonymous> (http://localhost:4400/scripts/libs/aws-sdk.js:167302:9)
    at Request.<anonymous> (http://localhost:4400/scripts/libs/aws-sdk.js:167949:12)
the signature you provided.

更糟糕的是，其他亚马逊网络服务调用，例如对DynamoDB的调用，使用相同的凭据都没有问题！

这两个服务使用完全相同的凭据进行调用。

认知用户角色被授予对所有CognitoSync操作和资源的访问权限。

我已经在Amazon和Github线程上尝试了所有的解决方案，这些解决方案甚至与我的问题有很小的关联，但没有运气，因为它们中的大多数都是开发人员工具，使用硬编码和手动生成的访问密钥进行身份验证，而我使用用户的Cognito身份凭证对用户进行身份验证。

下面是失败的CognitoSync.listDatasets请求：

Request URL: http://localhost:4400/xhr_proxy?rurl=https%3A//cognito-sync.us-east-1.amazonaws.com/identitypools/us-east-1%253A2bc13d33-35df-4da6-9c18-0e75a887eb38/identities/us-east-1%253A092beff5-9f9d-484f-a757-fc73531b0d2d/datasets
Request Method: GET
Status Code: 403 Forbidden
Remote Address: [::1]:4400
Referrer Policy: no-referrer-when-downgrade

GET /xhr_proxy?rurl=https%3A//cognito-sync.us-east-1.amazonaws.com/identitypools/us-east-1%253A2bc13d33-35df-4da6-9c18-0e75a887eb38/identities/us-east-1%253A992beff5-9f9d-484f-a757-fc73531b0d2d/datasets HTTP/1.1
Host: localhost:4400
Connection: keep-alive
Authorization: AWS4-HMAC-SHA256 Credential=GSIAZFP73J6WBXVLXVGG/20190609/us-east-1/cognito-sync/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-user-agent, Signature=5dfc5e765a9bebc22f31ba76005b177e4283aa22f51194142f6c7b12c7f911e8
Content-Type: application/json
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
x-amz-security-token: AgoGb3JpZ2luEJv...+zy5wU=
X-Amz-Date: 20190609T073401Z
X-Amz-User-Agent: aws-sdk-js/2.471.0 callback
Accept: */*
Referer: http://localhost:4400/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

下面是成功的DynamoDB.listTables请求：

Request URL: http://localhost:4400/xhr_proxy?rurl=https%3A//dynamodb.us-east-1.amazonaws.com/
Request Method: POST
Status Code: 200 OK
Remote Address: [::1]:4400
Referrer Policy: no-referrer-when-downgrade

POST /xhr_proxy?rurl=https%3A//dynamodb.us-east-1.amazonaws.com/ HTTP/1.1
Host: localhost:4400
Connection: keep-alive
Content-Length: 2
Origin: http://localhost:4400
Authorization: AWS4-HMAC-SHA256 Credential=GSIAZFP73J6WBXVLXVGG/20190609/us-east-1/dynamodb/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-target;x-amz-user-agent, Signature=9ffb9c0c1d32fe18461c6398102c903d3b174f1175a7e628c2f4ca6e6a5ddf24
Content-Type: application/x-amz-json-1.0
X-Amz-Content-Sha256: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
x-amz-security-token: AgoGb3JpZ2luEJv...+zy5wU=
X-Amz-Target: DynamoDB_20120810.ListTables
X-Amz-Date: 20190609T073401Z
X-Amz-User-Agent: aws-sdk-js/2.471.0 callback
Accept: */*
Referer: http://localhost:4400/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

下面是我的代码的相关部分的片段：

let credentials: AWS.CognitoIdentityCredentials = new window.aws.CognitoIdentityCredentials({
    IdentityPoolId: Config.awsIdentityPoolId,
    Logins: logins,
});

credentials.refresh((err) =>
{
    if (err) { reject(err); }
    else { resolve(); }
});

// await for credentials promise above to resolve

let params = {
    IdentityId: credentials.identityId,
    IdentityPoolId: Config.awsIdentityPoolId
}
this.dynamoDB = new window.aws.DynamoDB();
this.dynamoDB.listTables({}, (err, data) =>
{
    if (err) { console.log(err); }
    else { console.log(data); }
});

this.cognitoSync = new window.aws.CognitoSync();
this.cognitoSync.listDatasets(params, (err, data) =>
{
    if (err) { console.log(err); }
    else { console.log(data);}
});

Answer 1

我最终在图书馆的github页面上提出了我的问题，因为我在这里没有得到答案。我在那里也没有得到答案，所以我试图在库的源代码中找到这个问题。

事实证明这是一个库错误，在生成签名时对url进行双重转义。这是我的解决方案的链接。https://github.com/aws/aws-sdk-js/issues/2706#issuecomment-501125092

我也会在这里粘贴解决方案，以防有人现在需要热修复。

我通过在v4.js (或者aws-sdk.js，如果你正在使用这个发行版)中修改了以下代码，解决了这个问题。

  canonicalString: function canonicalString() {
    var parts = [], pathname = this.request.pathname();
    if (this.serviceName !== 's3' && this.signatureVersion !== 's3v4') pathname = AWS.util.uriEscapePath(pathname);

    parts.push(this.request.method);
    parts.push(pathname);
    parts.push(this.request.search());
    parts.push(this.canonicalHeaders() + '\n');
    parts.push(this.signedHeaders());
    parts.push(this.hexEncodedBodyHash());
    return parts.join('\n');
  }

至

  canonicalString: function canonicalString() {
    var parts = [], pathname = this.request.pathname();
    if (this.serviceName !== 'cognito-sync' && this.serviceName !== 's3' && this.signatureVersion !== 's3v4') pathname = AWS.util.uriEscapePath(pathname);

    parts.push(this.request.method);
    parts.push(pathname);
    parts.push(this.request.search());
    parts.push(this.canonicalHeaders() + '\n');
    parts.push(this.signedHeaders());
    parts.push(this.hexEncodedBodyHash());
    return parts.join('\n');
  }