在签署我的请求时，我做错了什么？AWS SignatureV4和PHP

Question

我在这个问题上纠缠了两天。我已经编写了一个Python脚本，它向AWS Pinpoint服务发出PUT请求。像许多其他AWS服务一样，Pinpoint需要对请求进行签名身份验证，我用Python处理了这一点。

现在，我正试图将我的脚本翻译成一个用于Symfony的PHP服务。当我运行我的第一个AWS pinpoint请求时，我得到：

我们计算的请求签名与您提供的签名不匹配。检查您的AWS秘密访问密钥和签名方法。有关详细信息，请参阅维修文档。此请求的规范字符串应该是\n'PUT\n/v1/apps/../endpoints/..\n\n内容类型：application/json\nhost:pinpoint.eu-west-1.amazonaws.com\nx-amz-content-sha256:de98d86577f0e1…655e6de27154af1c05ab34\nx amz日期：20191226T151542Z\nx amz安全令牌：ikojb….\nx amz用户代理：aws amplify/1.1.1.2aws amplify/1.1.2 react本机回调\n\n内容类型；主办x-amz-content-sha256；x-amz-date；x-amz-security-token；x-amz-user-agent\n0240a9479d0a66d74eaae42dc…95247aaa800fcbe5cf2

字符串到签名应该是'AWS4-HMAC-SHA256\n20191226T151542Z\n20191226/eu-west-1/Mobie-Argting/aws4_request\nb2c451534fe370503ecf4068b45c...63e91280cc3187ae3230034107

所以我已经检查了我的规范字符串是否错误，这与AWS的要求完全相同。要签名的字符串与规范字符串哈希不同。

这是我的标题函数

public function create_headers($data,\DateTime $time,$canonical_uri,$method,$to_api=null)
    {
        $amz_date = $time->format('Ymd\THis\Z');
        $date_stamp = $time->format('Ymd');
        $payload_hash = hash('sha256',$data);#utf8_encode($data));
        $canonical_querystring = "";
        $canonical_headers = 'content-type:' . $this->content_type . '\n' . 'host:' . $this->host . '\n' . 'x-amz-content-sha256:' . $payload_hash . '\n' . 'x-amz-date:' . $amz_date . '\n' . 'x-amz-security-token:' . $this->security_token . '\n' . 'x-amz-user-agent:aws-amplify/1.1.2 react-native aws-amplify/1.1.2 react-native callback' . '\n';
        $signed_headers = 'content-type;host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-user-agent';


        $canonical_request = $method . '\n' . $canonical_uri . '\n' . $canonical_querystring . '\n' . $canonical_headers . '\n' . $signed_headers . '\n' . $payload_hash;

        echo '<br><br>';
        print_r(str_replace('\n','<br>',$canonical_request));
        #var_dump($canonical_request);
        $algorithm = 'AWS4-HMAC-SHA256';
        $credential_scope = "{$date_stamp}/{$this->region}/{$this->service}/aws4_request";
            #$date_stamp . '/' . $this->region . '/' . $this->service . '/' . 'aws4_request';
        #$credential_scope = $this->createScope($date_stamp,$this->region,$this->service);
        echo '<br><br>';
        #$string_to_sign = $algorithm . '\n' .  $amz_date . '\n' .  $credential_scope . '\n' .  hash('sha256', utf8_encode($canonical_request));
        $hash = hash('sha256', $canonical_request);
        $string_to_sign = "AWS4-HMAC-SHA256\n{$amz_date}\n{$credential_scope}\n{$hash}";
        print_r(str_replace('\n','<br>',$string_to_sign));
        echo '<br><br>';



        $signing_key = $this->get_signature_key($this->secret_key,$date_stamp,$this->region,$this->service);
        $signature = hash_hmac('sha256',$string_to_sign,$signing_key);

        $authorization_header = $algorithm . ' ' . 'Credential=' . $this->access_key . '/' . $credential_scope . ', ' .  'SignedHeaders=' . $signed_headers . ', ' . 'Signature=' . $signature;

        $headers = array(
            'host'=> $this->host,
            'content-type'=> $this->content_type,
            'x-amz-user-agent'=> 'aws-amplify/1.1.2 react-native aws-amplify/1.1.2 react-native callback',
            'x-amz-content-sha256'=> $payload_hash,
            'x-amz-security-token'=> $this->security_token,
            'x-amz-date'=> $amz_date,
            'authorization'=> $authorization_header
        );
        $this->s->headers = $headers;
        return $headers;
    }

几天来我一直在寻找我的错误，但我想我需要一个有新眼光的人...

非常感谢。

Answer 1

经过几个小时对自己的质疑，我终于找到了为什么我会出错。

在PHP中，“\n”和“\n”的含义不同。

"\n"是一个真正的换行符-这就是AWS所要求的。
'\n'是由\和n个字符组成的字符串。

虽然AWS API仍然相当糟糕。