Google Apps 脚本：Amazon SP-API “无效签名问题”答案

【问题标题】：Google Apps Script: Amazon SP-API "Invalid signature issue"Google Apps 脚本：Amazon SP-API “无效签名问题”
【发布时间】：2022-10-16 07:01:03
【问题描述】：

我遇到了 Amazon SP-API 的问题，我正在尝试将其与 Google Apps 脚本连接。我正在尝试实现“获取订单”功能，但出现错误

message "我们计算的请求签名与您提供的签名不匹配。请检查您的 AWS 秘密访问密钥和签名方法。有关详细信息，请参阅服务文档。"
代码：“无效签名”

function sample() {
  const hex = bytes => bytes.map(byte => ('0' + (byte & 0xFF).toString(16)).slice(-2)).join('');
  const digestToHex = data => hex(Utilities.computeDigest(Utilities.DigestAlgorithm.SHA_256, data));
  const toBytes = data => Utilities.newBlob(data).getBytes();

  const ACCESS_ID = "access id";
  const ACCESS_KEY = "accesskey";
  var access_token = "accesstoken"; // AccessToken();

  //Time variables
  var formattedDate = Utilities.formatDate(new Date(), "GMT", "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
Logger.log(formattedDate);
var formattedDate2 = Utilities.formatDate(new Date(), "GMT", "yyyyMMdd'T'HHmmss'Z'");
Logger.log(formattedDate);
  var date = Utilities.formatDate(new Date(), "GMT", "yyyyMMdd");
  //API variables
  var end_point = 'https://sellingpartnerapi-eu.amazon.com';

  //Credential variables
  var aws_region = "eu-west-1";
  var service = "execute-api";
  var termination_string = "aws4_request";

  // 1. Create string to sign.
  var httpRequestMethod = 'GET';
  var canonicalURI = '/orders/v0/orders';
  var canonicalQueryString = '?marketplaceIds=A1PA6795UKMFR9';
  var canonicalagent = 'Mozilla/5.0 (compatible; Google-Apps-Script; beanserver; +https://script.google.com; id: UAEmdDd-lDKOJyTi7Hqx-u0ts2-d8CniiCA)'
  var canonicalheaders = canonicalURI + canonicalQueryString + 'host:' +end_point  + 'user-agent:' + canonicalagent + 'x-amz-access-token:' + access_token + '\n' + 'x-amz-date:' + formattedDate;
  var signedheaders = 'host;user-agent;x-amz-access-token;x-amz-date';
  const canonicalRequest = [httpRequestMethod,canonicalURI,canonicalagent,canonicalQueryString,canonicalheaders + "\n",signedheaders,digestToHex("")].join("\n");
  const canonical_request = digestToHex(canonicalRequest);
  var credential_scope = date + '/' + aws_region + '/' + service + '/' + termination_string;
  var string_to_sign = "'" + "AWS4-HMAC-SHA256" + '\n' + formattedDate2 + '\n' + credential_scope + '\n' + canonical_request +"'";

  // 2. Create derived signing key.
  var kSecret = ACCESS_KEY;
  var kDate = Utilities.computeHmacSha256Signature("AWS4" + kSecret, date);
  var kRegion = Utilities.computeHmacSha256Signature(toBytes(aws_region), kDate);
  var kService = Utilities.computeHmacSha256Signature(toBytes(service), kRegion);
  var kSigning = Utilities.computeHmacSha256Signature(toBytes(termination_string), kService);

  // 3. Create signature.
  const signature = hex(Utilities.computeHmacSha256Signature(toBytes(string_to_sign), kSigning));

  // 4. Request.
  var options = {
    'method': 'GET',
    'headers': {
      'x-amz-access-token': access_token,
      'x-amz-date': formattedDate,
      'Authorization': 'AWS4-HMAC-SHA256 Credential=' + ACCESS_ID + '/' + credential_scope + ', SignedHeaders=' + signedheaders + ', Signature=' + signature,
    },
    'muteHttpExceptions': true
  }
  var getOrders = UrlFetchApp.fetch(end_point + canonicalURI + canonicalQueryString, options);
  Logger.log(getOrders);
}

我得到的错误信息是：

{
  "errors": [
    {
      "message": "The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

The Canonical String for this request should have been
'GET
/orders/v0/orders
marketplaceIds=A1PA6795UKMFR9
host:sellingpartnerapi-eu.amazon.com
user-agent:Mozilla/5.0 (compatible; Google-Apps-Script; beanserver; +https://script.google.com; id: UAEmdDd-lDKOJyTi7Hqx-u0ts2-d8CniiCA)
x-amz-access-token: "access token"
x-amz-date:2022-07-24T17:02:13.069Z

host;user-agent;x-amz-access-token;x-amz-date
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'

The String-to-Sign should have been
'AWS4-HMAC-SHA256
20220724T170213Z
20220724/eu-west-1/execute-api/aws4_request
91bc4d49c907d821a39e12fc3ffb6b13e5da41ea5d0f483107dc1055ba3a151f'
",
     "code": "InvalidSignature"
    }
  ]
}

有人可以帮我解决这个问题吗？我对这些东西很陌生，所以不知道如何解决这个问题。谢谢！

【问题讨论】：

标签： google-apps-script amz-sp-api amazon-sp-api

【解决方案1】：

你最终设法解决了这个问题吗？我记得在 MWS 时代，对字符串进行排序很重要……以一种非常具体的方式，然后才能计算签名。但我认为这不是问题。

【讨论】：