C# + Google Storage 签名 URL：我们计算的请求签名与您提供的签名不匹配答案

【问题标题】：C# + Google Storage signed URL: The request signature we calculated does not match the signature you providedC# + Google Storage 签名 URL：我们计算的请求签名与您提供的签名不匹配
【发布时间】：2019-01-27 15:30:00
【问题描述】：

我刚刚创建了这个存储桶：mybucket231。

运行此 C# 代码以生成 Signed-Url：

using (var stream = new FileStream(@"path/to/secret.json", FileMode.Open, FileAccess.Read))
{
    var cred = GoogleCredential.FromStream(stream)
                               .CreateScoped("https://www.googleapis.com/auth/devstorage.full_control")
                               .UnderlyingCredential as ServiceAccountCredential;

    var urlSigner = UrlSigner.FromServiceAccountCredential(cred);
    var publicLink = urlSigner.Sign("mybucket231", "file.test", TimeSpan.FromHours(1));
}

此代码生成具有full_control 权限的签名 URL。返回网址如下所示：

https://storage.googleapis.com/mybucket231/file.test?GoogleAccessId=new-storage-service-account@dotnet-core-cluster.iam.gserviceaccount.com&Expires=1548606014&Signature=HbL0ETXucaldz8jpoUDXUzYQu2YyhiMUh4Nfm69Y0sLyG3pvqbVvMMK1N8agywE8gW8s7kkInJCJuVGH%2FAHzd4LfeYo62iFK....FjnImQZq7fftv4TF5SpCPsVFnOGkSD6vOIpKqfJiswqGIERC9D7EJ%2B2DZ9JVMP7cEYjmAB9miemtD2eTVXu3FpBNbnDoxp112eTmu2F4TAckS0toX%2FmYk8GhOc9UnWH1iZ5VJ%2FKslFmRU0NFu4nxkDv7rk%2FRCvsOvvqrOqJT6cezE%2Bz%2FMONh%2FK5KfPs0ZnYslQwYNojhVR4sn5L8tVNst6gclFnA%3D%3D

现在，我要去 Fiddler 并尝试使用以下命令创建文件：

PUT https://storage.googleapis.com/mybucket231/file.test?GoogleAccessId=new-storage-service-account@secret.iam.gserviceaccount.com&Expires=1548606014&Signature=HbL0ETXucaldz8jpoUDXUzYQu2YyhiMUh4Nfm69Y0sLyG3pvqbVvMMK1N8agywE8gW8s7kkInJCJuVGH%2FAHzd4LfeYo62iFK....FjnImQZq7fftv4TF5SpCPsVFnOGkSD6vOIpKqfJiswqGIERC9D7EJ%2B2DZ9JVMP7cEYjmAB9miemtD2eTVXu3FpBNbnDoxp112eTmu2F4TAckS0toX%2FmYk8GhOc9UnWH1iZ5VJ%2FKslFmRU0NFu4nxkDv7rk%2FRCvsOvvqrOqJT6cezE%2Bz%2FMONh%2FK5KfPs0ZnYslQwYNojhVR4sn5L8tVNst6gclFnA%3D%3D

Headers:
User-Agent: Fiddler
Host: storage.googleapis.com
Content-Length: 3
content-type: text/plain

Body:
Hello world!

此PUT 消息返回错误 403（禁止）并带有此消息：

<?xml version='1.0' encoding='UTF-8'?>
<Error>
    <Code>SignatureDoesNotMatch</Code>
    <Message>The request signature we calculated does not match the signature you provided. Check your Google secret key and signing method.</Message><StringToSign>PUT

plain/text
1548606014
/mybucket231/file.test</StringToSign>
</Error>

上面写着：SignatureDoesNotMatch。但这很奇怪。我创建了这个文件并尝试使用动词GET - 相同的签名确实有效！

怎么样？ PUT这个动词怎么解决？

注意：我的服务帐户 (new-storage-service-account@secret.iam.gserviceaccount.com) 是 StorageAdmin。

【问题讨论】：

标签： c# google-cloud-platform google-cloud-storage

【解决方案1】：

发现问题。实际上，这是两个问题：

您必须指定content-type 标头。所以添加
然后我遇到了另一个问题。允许 content-type 小写 - 这还不够！应该改为Content-Type。

最终代码：

string url = urlSigner.Sign(
            "mybucket231",
            "file.test",
            TimeSpan.FromHours(1),
            HttpMethod.Put,
            contentHeaders: new Dictionary<string, IEnumerable<string>> {
                    { "Content-Type", new[] { "text/plain" } }
                }
            );

【讨论】：