private bool VerifyRequest(VerifingContext ctx, string signAt, string authString)
{
var parts = authString.Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
if (parts.Length != 2)
{
_logger.LogWarning(897, "请求签名认证头格式错误：{0}", authString);
return(false);
}
if (parts[0] != Constants.FeiniuBus1AlgorithmTag)
{
_logger.LogWarning(897, "签名认证架构错误：{0}", parts[0]);
return(false);
}
var scheme = parts[0].Split(new[] { '-' }, StringSplitOptions.RemoveEmptyEntries)[0];
var auths = parts[1].Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries);
if (auths.Length != 3)
{
_logger.LogWarning(897, "请求签名体的格式不正确: {0}", parts[1]);
return(false);
}
if (!TryParseCredential(auths[0], out var id, out var shortedTime, out var credSuffix))
{
_logger.LogWarning(897, "Credential节错误: {0}", auths[0]);
return(false);
}
if (!TryParseSignedHeaders(auths[1], out var signedHeaders))
{
_logger.LogWarning(897, "SignedHeaders节错误：{0}", auths[1]);
return(false);
}
if (!TryParseSignature(auths[2], out var clientSignatures))
{
_logger.LogWarning(897, "Signature节错误：{0}", auths[2]);
return(false);
}
var credentialString = BuildCredentialString(shortedTime, credSuffix);
var bodyHash = SetRequestBodyHash(ctx.Body);
var parametersToCanonicalize =
GetParametersToCanonicalize(ctx.Query.ToDictionary(x => x.Key, y => y.Value.ToString()));
var canonicalQueryParams = CanonicalizeQueryParameters(parametersToCanonicalize);
var canonicalRequest = CanonicalizeRequest(ctx.Path, ctx.Method, ctx.Header, signedHeaders,
canonicalQueryParams, bodyHash);
var key = _getKeyFunc(id);
var signature = ComputeSignature(key, parts[0], signAt, shortedTime, credentialString, canonicalRequest,
scheme, credSuffix);
return(clientSignatures == signature);
}
public bool Verify(VerifingContext ctx)
{
if (!ctx.Header.TryGetValue(HeaderKeys.XFeiniuBusDateHeader, out var signAt))
{
_logger.LogWarning(897, "请求未包含签名时间戳");
return(false);
}
if (!ctx.Header.TryGetValue(HeaderKeys.AuthorizationHeader, out var authString))
{
_logger.LogWarning(897, "请求未包含签名认证头");
return(false);
}
return(VerifyRequest(ctx, signAt, authString));
}
