如何将 API 请求 (AWS SigV4) 签署到代理和 API 网关后面的 Lambda？

Question

我正在开发一个项目，目前我们使用 Cognito 用户池进行身份验证，但经过一些研究，我们发现如果我们想要更细粒度的访问控制，我们应该使用身份池。

理论很简单：首先我们创建一个身份池，使用 Cognito 用户池作为身份验证提供者。然后在 API Gateway 中我们设置 Lambda 以使用Authorizer: AWS_IAM. 要访问它，用户现在必须：

1. 登录用户池，这将为用户提供 JWT 令牌。
2. 将该 JWT 令牌与身份池交换为临时 AWS 凭证。
3. 使用这些新凭证向受保护的 Lambda 签署 API 请求。

第 1 步和第 2 步工作正常，通过测试用户，我们设法获取 JWT 令牌并成功将其交换为 AWS 凭证。它们看起来像这样（出于安全原因进行了修改）：

awsAccessKey: ASIAZFDXSW29NWI3QZ01

awsSecretKey: B+DrYdPMFGbDd1VRLSPV387uHT715zs7IsvdNnDk

awsSessionToken: IQoJb3JpZ2luX2VjEA8aCWV1LXdlc3QtMyJHMEUCIQC4kHasZrfnaMezJkcPtDD8YizZlKESas/a5N9juG/wIQIgShWaOIgIc4X9Xrtlc+wiGuSC1AQNncwoac2vFkpJ3gkqxAQIWBAAGgw2NTI5NTE0MDE0MDIiDDuTZ1aGOpVffl3+XCqhBDmjCS3+1vSsMqV1GxZ96WMoIoEC1DMffPrBhc+NnBf94eMOI4g03M5gAm3uKAVCBkKO713TsQMaf4GOqqNemFC8LcJpKNrEQb+c+kJqqf7VWeWxveuGuPdHl1dmD2/lIc8giY0+q4Wgtbgs6i0/gR5HzdPfantrElu+cRNrn/wIq4Akf+aARUm14XsIgq7/1fT9aKSHpTgrnTLHeXLKOyf/lZ947XdH71IHDZXBUdwdPikJP/Rikwill6RRTVw7kGNOoacagCmmK7CD6uh9h0OnoW3Qw5df+zX5Z8U7U55AyQfEyzeB7bW3KH65yJn6sopegxIIFfcG2CLIvtb5cZYImAz/4BdnppYpsrEgLPUTvRAXn6KUa5sXgc5Vd7tJeRo5qpYckrR2qfbebsU+0361BCYK2HxGJqsUyt1GVsEoAosxofpn/61mYJXqfeR0ifCAgL7OMOquvlaUVXhHmnhWnUSIOUQ+XtRc+DxUDjwn5RPD7QTwLHIat7d4BI4gZJPAcMT9gZrBVO/iN88lk5R0M5LBzFwd5jiUW46H/G755I4e5ZHaT1I37TY3tbcObIFGVVNz5iHDpK/NePTJevKTshe8cYxXczOQgos4J/RsNpqouO9qRgT9JDyXjU3Etyxqm9RzbLYgV3fl5WwZl5ofVmrBsy3adq+088qEz5b9cogPgDggA/nQaPv7nAZHT8u0ct/hw230pmXUDGCutjOML2G6ZYGOoUCy+BitAN0SZOYWlbZlYomIGKMNQuXjV4z+S9CEW8VunqW4Rgl7rTba6xbI0DdX9upYEczeln6pTl+2UPEDYf6usayFfMsGDvJXesqC5EOtWco1Z8tem/wDQIH7ZbioQHZ7UJDd5ntUAruFveY7sXmKsQbtah/RB5W5HLYy19hCmyGpYMnVXxR0FcNGImsweNcprtw9MmQqy2SUK9V6Rwn1yIE6svfAT3NVyzp9ILbP/qSQLGHNhm4CNd8+EJZZa9rcmCbQiQ+iBJ8FW+AmRSCC4LiB1dhuH1KsFo88DyNhYdVf3py8XV4CDR7l+UyuZMrIQsERwx9JzwVBjfv9COT948mvyGTY

问题是签字。我们的 Lambda 位于 CloudFront 代理 + API 网关后面。对eg 的请求john.dev.project.io将转发至位于 的“真实”API 源api.dev.project.io。

使用 Postman 和设置AWS Signature，请求不起作用并给出以下错误：

The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'................................................................................................................................................................................................................................................................'\n\nThe String-to-Sign should have been\n'............................................................................'\n

然而我们发现，通过将标头覆盖Host到 API 的真实来源，请求现在可以正常工作：

如此看来，由于我们使用的自定义 URL 和原始 API URL 不同，因此签名不匹配。问题是，默认情况下，出于安全原因，浏览器不允许您覆盖Host标头，因此我们的前端签名请求总是失败。

也许代理在转发到原点之前还在修改其他标头，根据我的理解，这也会使签名无效......

任何帮助解决这个问题的帮助都值得赞赏！

Answer 1

当我尝试向 Akamai 代理后面的 API 网关端点发出签名请求时，我遇到了类似的问题。

解决这个问题的技巧确实是生成一个请求，就像直接将其发送到 API 网关 URL 一样，使用 sigv4 对该请求进行签名，然后将该签名的请求发送到代理端点。

我整理了一个简单的 NodeJS 代码来举例说明如何执行此操作：

const AWS = require("aws-sdk");

const { HttpRequest } = require("@aws-sdk/protocol-http");
const { SignatureV4 } = require("@aws-sdk/signature-v4");
const { NodeHttpHandler } = require("@aws-sdk/node-http-handler");
const { Sha256 } = require("@aws-crypto/sha256-browser");

const REGION = "ca-central-1";

const PROXY_DOMAIN = "proxy.domain.com";
const PROXY_PATH = "/proxypath";

const API_GATEWAY_DOMAIN = "API-ID.execute-api.ca-central-1.amazonaws.com";
const API_GATEWAY_PATH = "/apigateway/path";

const IDENTITY_ID = "{{identity-pool-region}}:{{identity-pool-id}}";
const POOL_REGION = "{{identity-pool-region}}";

const REQUEST_BODY = { test: "test" };
const METHOD = "POST";

const udpatedSignedRequestExample = async () => {
  try {
    const BODY = JSON.stringify(REQUEST_BODY);

    const request = new HttpRequest({
      body: BODY,
      headers: {
        "Content-Type": "application/json",
        host: API_GATEWAY_DOMAIN,
      },
      hostname: API_GATEWAY_DOMAIN,
      port: 443,
      method: METHOD,
      path: API_GATEWAY_PATH,
    });

    console.log("request", request);

    const credentials = await getCredentials();
    console.log(credentials);

    const signedRequest = await signRequest(request, credentials);
    console.log("signedRequest", signedRequest);

    const updatedSignedRequest = updateRequest(signedRequest);
    console.log("updatedSignedRequest", updatedSignedRequest);

    const response = await makeSignedRequest(updatedSignedRequest);
    console.log(response.statusCode + " " + response.body.statusMessage);
  } catch (error) {
    console.log(error);
  }
};

const getCredentials = async () => {
  var cognitoidentity = new AWS.CognitoIdentity({ region: POOL_REGION });
  var params = {
    IdentityId: IDENTITY_ID,
  };
  const response = await cognitoidentity
    .getCredentialsForIdentity(params)
    .promise();

  return {
    accessKeyId: response.Credentials.AccessKeyId,
    secretAccessKey: response.Credentials.SecretKey,
    sessionToken: response.Credentials.SessionToken,
    expiration: response.Credentials.Expiration,
  };
};

const signRequest = async (request, credentials) => {
  const signer = new SignatureV4({
    credentials: credentials,
    region: REGION,
    service: "execute-api",
    sha256: Sha256,
  });

  const signedRequest = await signer.sign(request);
  return signedRequest;
};

const updateRequest = (httpRequest) => {
  httpRequest.hostname = PROXY_DOMAIN;
  httpRequest.path = PROXY_PATH;
  httpRequest.headers.host = PROXY_DOMAIN;

  return httpRequest;
};

const makeSignedRequest = async (httpRequest) => {
  const client = new NodeHttpHandler();
  const { response } = await client.handle(httpRequest);
  return response;
};

udpatedSignedRequestExample();

希望有帮助。