我正在Web应用程序中使用aws-sdk-js(v2.471.0)的最新版本。
用户已通过Cognito身份验证成功,并获得了有效的会话。
我的问题是所有CognitoSync
调用均失败,并显示相同的错误消息:
InvalidSignatureException: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.
at Object.extractError (http://localhost:4400/scripts/libs/aws-sdk.js:166311:27)
at Request.extractError (http://localhost:4400/scripts/libs/aws-sdk.js:166652:8)
at Request.callListeners (http://localhost:4400/scripts/libs/aws-sdk.js:169314:20)
at Request.emit (http://localhost:4400/scripts/libs/aws-sdk.js:169286:10)
at Request.emit (http://localhost:4400/scripts/libs/aws-sdk.js:167947:14)
at Request.transition (http://localhost:4400/scripts/libs/aws-sdk.js:167286:10)
at AcceptorStateMachine.runTo (http://localhost:4400/scripts/libs/aws-sdk.js:172800:12)
at http://localhost:4400/scripts/libs/aws-sdk.js:172812:10
at Request.<anonymous> (http://localhost:4400/scripts/libs/aws-sdk.js:167302:9)
at Request.<anonymous> (http://localhost:4400/scripts/libs/aws-sdk.js:167949:12)
the signature you provided.
更糟糕的是,其他AWS服务调用(例如,对DynamoDB
的使用相同的凭证也不会出现问题!
两个服务都使用完全相同的凭据进行呼叫。
授予认知用户角色所有CognitoSync
的操作和资源。
我已经在Amazon上尝试了所有解决方案,并且与这里的问题远程相关的Github线程也没有幸免,因为它们大多数是开发人员工具,并且使用硬编码和手动生成的访问密钥进行身份验证,而我正在使用其Cognito身份凭证对用户进行身份验证。
这是失败的CognitoSync.listDatasets
请求:
Request URL: http://localhost:4400/xhr_proxy?rurl=https%3A//cognito-sync.us-east-1.amazonaws.com/identitypools/us-east-1%253A2bc13d33-35df-4da6-9c18-0e75a887eb38/identities/us-east-1%253A092beff5-9f9d-484f-a757-fc73531b0d2d/datasets
Request Method: GET
Status Code: 403 Forbidden
Remote Address: [::1]:4400
Referrer Policy: no-referrer-when-downgrade
GET /xhr_proxy?rurl=https%3A//cognito-sync.us-east-1.amazonaws.com/identitypools/us-east-1%253A2bc13d33-35df-4da6-9c18-0e75a887eb38/identities/us-east-1%253A992beff5-9f9d-484f-a757-fc73531b0d2d/datasets HTTP/1.1
Host: localhost:4400
Connection: keep-alive
Authorization: AWS4-HMAC-SHA256 Credential=GSIAZFP73J6WBXVLXVGG/20190609/us-east-1/cognito-sync/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-user-agent, Signature=5dfc5e765a9bebc22f31ba76005b177e4283aa22f51194142f6c7b12c7f911e8
Content-Type: application/json
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
x-amz-security-token: AgoGb3JpZ2luEJv...+zy5wU=
X-Amz-Date: 20190609T073401Z
X-Amz-User-Agent: aws-sdk-js/2.471.0 callback
Accept: */*
Referer: http://localhost:4400/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
这是成功的DynamoDB.listTables
请求:
Request URL: http://localhost:4400/xhr_proxy?rurl=https%3A//dynamodb.us-east-1.amazonaws.com/
Request Method: POST
Status Code: 200 OK
Remote Address: [::1]:4400
Referrer Policy: no-referrer-when-downgrade
POST /xhr_proxy?rurl=https%3A//dynamodb.us-east-1.amazonaws.com/ HTTP/1.1
Host: localhost:4400
Connection: keep-alive
Content-Length: 2
Origin: http://localhost:4400
Authorization: AWS4-HMAC-SHA256 Credential=GSIAZFP73J6WBXVLXVGG/20190609/us-east-1/dynamodb/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-target;x-amz-user-agent, Signature=9ffb9c0c1d32fe18461c6398102c903d3b174f1175a7e628c2f4ca6e6a5ddf24
Content-Type: application/x-amz-json-1.0
X-Amz-Content-Sha256: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
x-amz-security-token: AgoGb3JpZ2luEJv...+zy5wU=
X-Amz-Target: DynamoDB_20120810.ListTables
X-Amz-Date: 20190609T073401Z
X-Amz-User-Agent: aws-sdk-js/2.471.0 callback
Accept: */*
Referer: http://localhost:4400/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
这是我代码的相关部分的片段:
let credentials: AWS.CognitoIdentityCredentials = new window.aws.CognitoIdentityCredentials({
IdentityPoolId: Config.awsIdentityPoolId,
Logins: logins,
});
credentials.refresh((err) =>
{
if (err) { reject(err); }
else { resolve(); }
});
// await for credentials promise above to resolve
let params = {
IdentityId: credentials.identityId,
IdentityPoolId: Config.awsIdentityPoolId
}
this.dynamoDB = new window.aws.DynamoDB();
this.dynamoDB.listTables({}, (err, data) =>
{
if (err) { console.log(err); }
else { console.log(data); }
});
this.cognitoSync = new window.aws.CognitoSync();
this.cognitoSync.listDatasets(params, (err, data) =>
{
if (err) { console.log(err); }
else { console.log(data);}
});
答案 0 :(得分:0)
我最终在库的github页面上问了我一个问题,因为我在这里没有答案。我也没有得到答案,所以我试图在lib的源代码中找到问题所在。
原来那是一个库错误,在生成签名时两次转义了url。 这是我的解决方案的链接。 https://github.com/aws/aws-sdk-js/issues/2706#issuecomment-501125092
如果有人现在需要修补程序,我也会在此处粘贴解决方案。
我通过更改v4.js
(如果您使用的是发行版,则为aws-sdk.js
)中的以下内容解决了该问题
canonicalString: function canonicalString() {
var parts = [], pathname = this.request.pathname();
if (this.serviceName !== 's3' && this.signatureVersion !== 's3v4') pathname = AWS.util.uriEscapePath(pathname);
parts.push(this.request.method);
parts.push(pathname);
parts.push(this.request.search());
parts.push(this.canonicalHeaders() + '\n');
parts.push(this.signedHeaders());
parts.push(this.hexEncodedBodyHash());
return parts.join('\n');
}
到
canonicalString: function canonicalString() {
var parts = [], pathname = this.request.pathname();
if (this.serviceName !== 'cognito-sync' && this.serviceName !== 's3' && this.signatureVersion !== 's3v4') pathname = AWS.util.uriEscapePath(pathname);
parts.push(this.request.method);
parts.push(pathname);
parts.push(this.request.search());
parts.push(this.canonicalHeaders() + '\n');
parts.push(this.signedHeaders());
parts.push(this.hexEncodedBodyHash());
return parts.join('\n');
}