如何使用Python在服务器端生成签名的url？

Question

我刚刚跟随https://developers.google.com/storage/docs/accesscontrol?hl=zh-TW#Signed-URLs使用gsutil生成签名的url，它工作得很好。在

但我的问题是“如何在服务器端生成签名的url？”在

上面的云存储链接提到了一个示例项目https://github.com/GoogleCloudPlatform/storage-signedurls-python

它适合应用程序引擎环境吗？如果是，私钥文件应该放在哪里？在

或者有更好的方法来回答这个问题吗？在

Answer 1

我们是如何做到的：

第1步：获取p12文件/证书

从https://console.developers.google.com/下载p12文件 “API和身份验证/凭据”选项卡。在

第2步：将p12文件转换为DER格式

找到一台打开的Linux计算机并使用终端连接 命令：

openssl pkcs12 -in <filename.p12> -nodes -nocerts > <filename.pem>
# The current Google password for the p12 file is `notasecret`

openssl rsa -in <filename.pem> -inform PEM -out <filename.der> -outform DER

第3步：将DER文件转换为base64编码字符串

Python控制台：

^{pr2}$

复制并粘贴到应用程序引擎脚本中。在

第4步：在AppEngine中启用PyCrypto

在应用程序yaml必须有一行才能启用PyCrypto:

- name: pycrypto
  version: latest

第5步：创建签名URL的Python代码

import Crypto.Hash.SHA256 as SHA256
import Crypto.PublicKey.RSA as RSA
import Crypto.Signature.PKCS1_v1_5 as PKCS1_v1_5

der_key = “””<copy-paste-the-base64-converted-key>”””.decode('base64')

bucket = <your cloud storage bucket name (default is same as app id)>
filename = <path + filename>

valid_seconds = 5
expiration = int(time.time() + valid_seconds)

signature_string = 'GET\n\n\n%s\n' % expiration
signature_string += bucket + filename



# Sign the string with the RSA key.
signature = ''
try:
  start_key_time = datetime.datetime.utcnow()
  rsa_key = RSA.importKey(der_key, passphrase='notasecret')
  #objects['rsa_key'] = rsa_key.exportKey('PEM').encode('base64')
  signer = PKCS1_v1_5.new(rsa_key)
  signature_hash = SHA256.new(signature_string)
  signature_bytes = signer.sign(signature_hash)
  signature = signature_bytes.encode('base64')

  objects['sig'] = signature
except:
  objects['PEM_error'] = traceback.format_exc()

try:
  # Storage
  STORAGE_CLIENT_EMAIL = <Client Email from Credentials console: Service Account Email Address>
  STORAGE_API_ENDPOINT = 'https://storage.googleapis.com'

  # Set the query parameters.
  query_params = {'GoogleAccessId': STORAGE_CLIENT_EMAIL,
                'Expires': str(expiration),
                'Signature': signature}


  # This is the signed URL:
  download_href = STORAGE_API_ENDPOINT + bucket + filename + '?' + urllib.urlencode(query_params)

except:
  pass

来源

How to get the p12 file.

Signing instructions.

Inspiration for how to sign the url.

Answer 2

如果您使用的是Python，则有一个示例Python应用程序生成名为storage-signedurls-python的签名url。在