当前位置：首页 > 软件库 > 云计算 > >

s3-signer

☁️ Presigned S3 URLs for Haskell

授权协议 BSD-2-Clause License

开发语言 Haskell

所属分类云计算

软件类型开源软件

地区不详

投递者姚雅珺

操作系统跨平台

开源组织无

适用人群未知

软件概览

s3-signer

s3-signer is intended to be an aid in building secure cloud-based services withAWS. This library generates cryptographically secure URLs thatexpire at a user-defined interval. These URLs can be used to offloadthe process of uploading and downloading large files, freeing yourwebserver to focus on other things.

Features

Minimal depedencies
Web framework agnostic
Reduces web server load
Simple API
Ideal for AJAX direct-to-s3 upload scenarios

Documentation

S3 Query String Request Authentication

Implementation

AWS Specification

Signature = URL-Encode( Base64( HMAC-SHA1( YourSecretAccessKeyID,UTF-8-Encoding-Of( StringToSign ) ) ) );

Haskell Implementation

module Network.S3.Sign  ( sign ) where

import           Crypto.Hash.SHA1       (hash)
import           Crypto.MAC.HMAC        (hmac)
import qualified Data.ByteString.Base64 as B64
import           Data.ByteString.UTF8   (ByteString)
import           Network.HTTP.Types.URI (urlEncode)

-- | HMAC-SHA1 Encrypted Signature
sign :: ByteString -> ByteString -> ByteString
sign secretKey url = urlEncode True . B64.encode $ hmac hash 64 secretKey url

Use Case

{-# LANGUAGE OverloadedStrings #-}

module Main where

import           Network.S3

main :: IO ()
main = print =<< generateS3URL credentials request
  where
     credentials = S3Keys "<public-key-goes-here>" "<secret-key-goes-here>"
     request     = S3Request S3GET "application/zip" "bucket-name" "file-name.extension" 3 -- 3 secs until expired

Result

S3URL {
      signedRequest =
         "https://bucket-name.s3.amazonaws.com/file-name.extension?AWSAccessKeyId=<public-key-goes-here>&Expires=1402346638&Signature=1XraY%2Bhp117I5CTKNKPc6%2BiihRA%3D"
     }

Snap integration - Downloads

-- Quick and dirty example
type FileID = ByteString

makeS3URL :: FileID -> IO S3URL
makeS3URL fileId = generateS3URL credentials request
  where
    credentials = S3Keys "<public-key-goes-here>" "<secret-key-goes-here>"
    request     = S3Request S3GET "application/zip" "bucket-name" (fileId <> ".zip") 3 

downloadFile :: Handler App (AuthManager App) ()
downloadFile = method POST $ currentUserId >>= maybe the404 handleDownload
  where handleDownload uid = do
          Just fileId <- getParam "fileId"
          -- Ensure file being requested belongs to user else 403...
          S3URL url <- liftIO $ makeS3URL fileId
          redirect' url 302

Direct to S3 AJAX Uploads

Configure S3 Bucket CORS Policy settings
CORS Docs

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
    <CORSRule>
        <AllowedOrigin>https://my-url-goes-here.com</AllowedOrigin>
        <AllowedMethod>PUT</AllowedMethod>
        <AllowedHeader>*</AllowedHeader>
    </CORSRule>
</CORSConfiguration>

Retrieve PUT Request URL via AJAX

type FileID = ByteString

makeS3URL :: FileID -> IO S3URL
makeS3URL fileId = generateS3URL credentials request
  where
    credentials = S3Keys "<public-key-goes-here>" "<secret-key-goes-here>"
    request     = S3Request S3PUT "application/zip" "bucket-name" (fileId <> ".zip") 3 

getUploadURL :: Handler App (AuthManager App) ()
getUploadURL = method POST $ currentUserId >>= maybe the404 handleDownload
  where handleDownload _ = do
          Just fileId <- getParam "fileId"
          writeJSON =<< Data.Text.Encoding.decodeUtf8 <$> liftIO (makeS3URL fileId)

Embed FileReader blob data to request
Send upload request

var xhr = new XMLHttpRequest();
xhr.open('PUT', url /* S3-URL generated from server */);
xhr.setRequestHeader('Content-Type', 'application/zip'); /* whatever http-content-type makes sense */
xhr.setRequestHeader('x-amz-acl', 'public-read');

/* upload completion check */
xhr.onreadystatechange = function(e) {
    if (this.readyState === 4 && this.status === 200) 
          console.log('upload complete');
};

/* Amazon gives you progress information on AJAX Uploads */
xhr.upload.addEventListener("progress", function(evt) {
       if (evt.lengthComputable) {
          var v = (evt.loaded / evt.total) * 100,
          val = Math.round(v) + '%',
          console.log('Completed: ' + val);
      }
}, false);

/* error handling */
xhr.upload.addEventListener("error", function(evt) {
   console.log("There has been an error :(");
}, false);

/* Commence upload */
xhr.send(file); // file here is a blob from the file reader API

File Reader Info

How to read file data from the browser

Troubleshoooting

Why do I keep getting 403 forbidden when I attempt to upload or download from a pre-signed URL?
- Ask yourself the following:
  - Are my keys specified correctly?
  - Did I configure the CORS settings on my bucket properly?
  - Still trouble? Make an issue
Why are my URLs expiring faster than the specified time?
- Ask yourself the following:
  - Is my server's clock synchronized with AWS? See wiki for NTP info

FAQ

Why didn't you use HMAC-SHA256?
- It's 30% slower, and for all intents and purposes no more securethan HMAC-SHA1 (no known vulnerabilities exist for it, to my knowledge). PlainSHA1 is a different story. Collisions can be found, but there isno known way to apply those to HMAC-SHA1.
- For the curious SHA-1 is broken
- For the paranoid (Schneier quote from same article above)
- Relevant SO Post

This attack builds on previous attacks on SHA-0 and SHA-1, and isa major, major cryptanalytic result. It pretty much puts a bulletinto SHA-1 as a hash function for digital signatures (although itdoesn't affect applications such as HMAC where collisions aren't important).

使用案例

访问被拒绝 - 使用预签名URL的S3资源 - PHP SDK

我正在生成一个预签名URL，允许用户从S3存储桶下载文件 . 我使用以下代码通过PHP SDK生成URL： public static function get_content_link( $bucket, $key ) { //check response code from AWS require_once 'aws/aws-autoloader.php'; $s3 = new Aws\S3\
C# 调用 aws-s3-api 上传下载数据到minio上

C++ 封装动态库 #pragma once #include "TDGeoAnalysis/TDPreDefine.h" #include <aws/core/Aws.h> #include <aws/s3/S3Client.h> #include <aws/core/auth/AWSCredentialsProvider.h> using namespace Aws::S3; using na
兼容S3 SDK-Android

SDK-Android 概述您可以使用Android SDK管理互盟云对象存储，可从https://github.com/aws/aws-sdk-android 下载Android Source Code 操作由于android sdk用chunk 方式进行传输，并且把chunk-signature放置在body中，oss不支持这种case；sdk中支持的参数 S3ClientOptions.
aws s3 minio

#include “AwsClient.h” #include <aws/core/Aws.h> #include <aws/core/auth/AWSCredentialsProvider.h> #include <aws/core/client/DefaultRetryStrategy.h> #include <aws/s3/model/GetObjectRequest.h> #include
aws-sdk-s3 C++操作minio进行文件上传和下载

#pragma once #include "TDPreDefine.h" #include <aws/s3/S3Client.h> #include <aws/core/Aws.h> #include <aws/core/auth/AWSCredentialsProvider.h> using namespace Aws::S3; using namespace Aws::S3::Model;
Amazonaws S3 java SDK连接初探

*/ packagecom.inslink.sinosoft.util;importjava.io.File;importjava.io.FileNotFoundException;importjava.io.FileOutputStream;importjava.io.IOException;importjava.util.List;importcom.amazonaws.AmazonServi
关于向S3服务器上传中文名称文件失败的处理办法

一开始的时候，使用 amazonS3.putObject(request.withGeneralProgressListener(new ProgressListener() { long readedbyte = 0; @Override public void progressChanged(ProgressEvent progressEvent) {

s3-signer

s3-signer

Features

Documentation

Implementation

Use Case

Result

Snap integration - Downloads

Direct to S3 AJAX Uploads

File Reader Info

Troubleshoooting

FAQ

同类工具

相关阅读

相关文章

相关问答

相关文档