gcloud-node - 如何确保通过签名 URL 上传到 Google Cloud Storage 的文件是公开可读的？答案

【问题标题】：gcloud-node - How do I ensure that files uploaded to Google Cloud Storage via signed URLs are publicly readable?gcloud-node - 如何确保通过签名 URL 上传到 Google Cloud Storage 的文件是公开可读的？
【发布时间】：2016-09-10 06:26:30
【问题描述】：

我想允许客户端（浏览器中的 JavaScript）将文件上传到 Google Cloud Storage，我目前通过生成 signed URLs 来实现这一点。但是，默认情况下，上传的文件是私有的。如何确保通过签名 URL 上传的文件是公开可读的？

【问题讨论】：

标签： javascript node.js google-cloud-storage google-cloud-platform

【解决方案1】：

控制文件 ACL 通过标头 x-goog-acl 处理，计算签名 URL 时也必须包含该标头。为便于公众阅读，请使用值public-read。

示例客户端代码：

let request = new XMLHttpRequest()
request.onreadystatechange = () => {
  if (request.readyState === XMLHttpRequest.DONE) {
    if (request.status === 200) {
      console.log(`Google Cloud Storage upload was successful:`, request.responseText)
    } else {
      console.log(`Google Cloud Storage upload was not successful: ${request.status}`)
    }
  }
}

request.open('PUT', signedUrl, true)
// Don't care about content-type header for signature calculation
request.setRequestHeader('content-type', 'ignore')
request.setRequestHeader('x-goog-acl', 'public-read')
request.send(file)

示例服务器端代码（用于获取签名 URL）：

let gcloud = require('gcloud')
let moment = require('moment')

let gcs = gcloud.storage({
  projectId: process.env.GCLOUD_PROJECT_ID,
  credentials: {
    client_email: process.env.GCLOUD_CLIENT_EMAIL,
    private_key: process.env.GCLOUD_PRIVATE_KEY,
  },
})

let bucket = gcs.bucket('aBucket')
let cloudFile = bucket.file('aFile')
cloudFile.getSignedUrl({
  action: 'write',
  expires: moment.utc().add(1, 'days').format(),
  contentType: 'ignore',
  extensionHeaders: {'x-goog-acl': 'public-read',},
}, (error, signedUrl) => {
  if (error != null) {
    console.log(`Failed to obtain signed URL for file`)
  } else {
    console.log(`Got signed URL for file: ${signedUrl}`)
  }
})

【讨论】：