Question

我只是跟着https://developers.google.com/storage/docs/accesscontrol?hl=zh-TW#Signed-URLs使用gsutil生成签名的网址，它运行正常。

但我的问题是“如何在服务器端生成签名网址？”

上述云存储链接提到了一个示例项目https://github.com/GoogleCloudPlatform/storage-signedurls-python

它是否适合App Engine环境？如果是这样，私钥文件应该放在哪里？

或者有更好的方法来解决这个问题吗？

Answer 1

如果您使用的是Python，则会有一个示例Python应用程序生成名为storage-signedurls-python的签名URL。

Answer 2

以下是我们如何运作：

第1步：获取p12文件/证书

从https://console.developers.google.com/下载p12文件 “API＆amp; auth / Credentials“选项卡。

第2步：将p12文件转换为DER格式

查找Linux计算机打开并使用终端进行连接命令：

openssl pkcs12 -in <filename.p12> -nodes -nocerts > <filename.pem>
# The current Google password for the p12 file is `notasecret`

openssl rsa -in <filename.pem> -inform PEM -out <filename.der> -outform DER

第3步：将DER文件转换为base64编码的字符串

Python控制台：

private_key = open(‘<filename.der>’, 'rb').read()
print private_key.encode('base64')

复制并粘贴到App引擎脚本中。

第4步：在AppEngine中启用PyCrypto

app.yaml必须有一行来启用PyCrypto：

- name: pycrypto
  version: latest

第5步：创建签名网址的Python代码

import Crypto.Hash.SHA256 as SHA256
import Crypto.PublicKey.RSA as RSA
import Crypto.Signature.PKCS1_v1_5 as PKCS1_v1_5

der_key = “””<copy-paste-the-base64-converted-key>”””.decode('base64')

bucket = <your cloud storage bucket name (default is same as app id)>
filename = <path + filename>

valid_seconds = 5
expiration = int(time.time() + valid_seconds)

signature_string = 'GET\n\n\n%s\n' % expiration
signature_string += bucket + filename



# Sign the string with the RSA key.
signature = ''
try:
  start_key_time = datetime.datetime.utcnow()
  rsa_key = RSA.importKey(der_key, passphrase='notasecret')
  #objects['rsa_key'] = rsa_key.exportKey('PEM').encode('base64')
  signer = PKCS1_v1_5.new(rsa_key)
  signature_hash = SHA256.new(signature_string)
  signature_bytes = signer.sign(signature_hash)
  signature = signature_bytes.encode('base64')

  objects['sig'] = signature
except:
  objects['PEM_error'] = traceback.format_exc()

try:
  # Storage
  STORAGE_CLIENT_EMAIL = <Client Email from Credentials console: Service Account Email Address>
  STORAGE_API_ENDPOINT = 'https://storage.googleapis.com'

  # Set the query parameters.
  query_params = {'GoogleAccessId': STORAGE_CLIENT_EMAIL,
                'Expires': str(expiration),
                'Signature': signature}


  # This is the signed URL:
  download_href = STORAGE_API_ENDPOINT + bucket + filename + '?' + urllib.urlencode(query_params)

except:
  pass

<强>来源

How to get the p12 file.

Signing instructions.

Inspiration for how to sign the url.

如何使用Python在服务器端生成签名的URL？

2 个答案: