将 aws-sdk-js 与 CognitoSync 服务一起使用时出现 InvalidSignatureException

Question

我在我的网络应用程序中使用最新版本的aws-sdk-js (v2.471.0)。

用户已通过 Cognito Identity 成功验证并获得有效会话。 我的问题是所有CognitoSync 调用都失败并显示相同的错误消息：

InvalidSignatureException: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.
    at Object.extractError (http://localhost:4400/scripts/libs/aws-sdk.js:166311:27)
    at Request.extractError (http://localhost:4400/scripts/libs/aws-sdk.js:166652:8)
    at Request.callListeners (http://localhost:4400/scripts/libs/aws-sdk.js:169314:20)
    at Request.emit (http://localhost:4400/scripts/libs/aws-sdk.js:169286:10)
    at Request.emit (http://localhost:4400/scripts/libs/aws-sdk.js:167947:14)
    at Request.transition (http://localhost:4400/scripts/libs/aws-sdk.js:167286:10)
    at AcceptorStateMachine.runTo (http://localhost:4400/scripts/libs/aws-sdk.js:172800:12)
    at http://localhost:4400/scripts/libs/aws-sdk.js:172812:10
    at Request.<anonymous> (http://localhost:4400/scripts/libs/aws-sdk.js:167302:9)
    at Request.<anonymous> (http://localhost:4400/scripts/libs/aws-sdk.js:167949:12)
the signature you provided.

更糟糕的是，其他 AWS 服务调用，例如对 DynamoDB 的调用，使用相同的凭据没有问题！

两个服务都使用完全相同的凭据进行调用。

cognito 用户角色有权访问所有 CognitoSync 操作和资源。

我已经尝试了亚马逊上的所有解决方案，以及与我的问题远程相关的 Github 线程，但没有运气，因为它们中的大多数都是开发人员工具，并且使用硬编码和手动生成的访问密钥进行身份验证，而我正在使用他们的 Cognito 身份凭证对用户进行身份验证。

这是失败的CognitoSync.listDatasets 请求：

Request URL: http://localhost:4400/xhr_proxy?rurl=https%3A//cognito-sync.us-east-1.amazonaws.com/identitypools/us-east-1%253A2bc13d33-35df-4da6-9c18-0e75a887eb38/identities/us-east-1%253A092beff5-9f9d-484f-a757-fc73531b0d2d/datasets
Request Method: GET
Status Code: 403 Forbidden
Remote Address: [::1]:4400
Referrer Policy: no-referrer-when-downgrade

GET /xhr_proxy?rurl=https%3A//cognito-sync.us-east-1.amazonaws.com/identitypools/us-east-1%253A2bc13d33-35df-4da6-9c18-0e75a887eb38/identities/us-east-1%253A992beff5-9f9d-484f-a757-fc73531b0d2d/datasets HTTP/1.1
Host: localhost:4400
Connection: keep-alive
Authorization: AWS4-HMAC-SHA256 Credential=GSIAZFP73J6WBXVLXVGG/20190609/us-east-1/cognito-sync/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-user-agent, Signature=5dfc5e765a9bebc22f31ba76005b177e4283aa22f51194142f6c7b12c7f911e8
Content-Type: application/json
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
x-amz-security-token: AgoGb3JpZ2luEJv...+zy5wU=
X-Amz-Date: 20190609T073401Z
X-Amz-User-Agent: aws-sdk-js/2.471.0 callback
Accept: */*
Referer: http://localhost:4400/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

这是成功的DynamoDB.listTables 请求：

Request URL: http://localhost:4400/xhr_proxy?rurl=https%3A//dynamodb.us-east-1.amazonaws.com/
Request Method: POST
Status Code: 200 OK
Remote Address: [::1]:4400
Referrer Policy: no-referrer-when-downgrade

POST /xhr_proxy?rurl=https%3A//dynamodb.us-east-1.amazonaws.com/ HTTP/1.1
Host: localhost:4400
Connection: keep-alive
Content-Length: 2
Origin: http://localhost:4400
Authorization: AWS4-HMAC-SHA256 Credential=GSIAZFP73J6WBXVLXVGG/20190609/us-east-1/dynamodb/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token;x-amz-target;x-amz-user-agent, Signature=9ffb9c0c1d32fe18461c6398102c903d3b174f1175a7e628c2f4ca6e6a5ddf24
Content-Type: application/x-amz-json-1.0
X-Amz-Content-Sha256: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
x-amz-security-token: AgoGb3JpZ2luEJv...+zy5wU=
X-Amz-Target: DynamoDB_20120810.ListTables
X-Amz-Date: 20190609T073401Z
X-Amz-User-Agent: aws-sdk-js/2.471.0 callback
Accept: */*
Referer: http://localhost:4400/index.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

这是我的代码相关部分的 sn-p：

let credentials: AWS.CognitoIdentityCredentials = new window.aws.CognitoIdentityCredentials({
    IdentityPoolId: Config.awsIdentityPoolId,
    Logins: logins,
});

credentials.refresh((err) =>
{
    if (err) { reject(err); }
    else { resolve(); }
});

// await for credentials promise above to resolve

let params = {
    IdentityId: credentials.identityId,
    IdentityPoolId: Config.awsIdentityPoolId
}
this.dynamoDB = new window.aws.DynamoDB();
this.dynamoDB.listTables({}, (err, data) =>
{
    if (err) { console.log(err); }
    else { console.log(data); }
});

this.cognitoSync = new window.aws.CognitoSync();
this.cognitoSync.listDatasets(params, (err, data) =>
{
    if (err) { console.log(err); }
    else { console.log(data);}
});

Answer 1

我最终在图书馆的 github 页面上问了我的问题，因为我在这里没有得到答案。我也没有得到答案，所以我试图在 lib 的源代码中追踪问题。

原来这是一个库错误，在生成签名时双重转义了 url。 这是我的解决方案的链接。 https://github.com/aws/aws-sdk-js/issues/2706#issuecomment-501125092

如果有人现在需要修补程序，我也会在此处粘贴解决方案。

我通过更改v4.js（或aws-sdk.js，如果您正在使用分发版）中的以下内容解决了这个问题

  canonicalString: function canonicalString() {
    var parts = [], pathname = this.request.pathname();
    if (this.serviceName !== 's3' && this.signatureVersion !== 's3v4') pathname = AWS.util.uriEscapePath(pathname);

    parts.push(this.request.method);
    parts.push(pathname);
    parts.push(this.request.search());
    parts.push(this.canonicalHeaders() + '\n');
    parts.push(this.signedHeaders());
    parts.push(this.hexEncodedBodyHash());
    return parts.join('\n');
  }

到

  canonicalString: function canonicalString() {
    var parts = [], pathname = this.request.pathname();
    if (this.serviceName !== 'cognito-sync' && this.serviceName !== 's3' && this.signatureVersion !== 's3v4') pathname = AWS.util.uriEscapePath(pathname);

    parts.push(this.request.method);
    parts.push(pathname);
    parts.push(this.request.search());
    parts.push(this.canonicalHeaders() + '\n');
    parts.push(this.signedHeaders());
    parts.push(this.hexEncodedBodyHash());
    return parts.join('\n');
  }