search

achrefB3 / google-api-java-client

Automatically exported from code.google.com/p/google-api-java-client
0 stars 0 forks source link

GoogleStorageAuthentication generates invalid signature #68

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
I'm unable to call the Google Storage API using GoogleStorageAuthentication

My code:
-------------------------------------------------------

public class GoogleStorage 
{
    HttpTransport transport;
    String apiKey = "MY_API_KEY";
    String secret = "MY_SECRET";

    private static final SimpleDateFormat httpDateFormat = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss z", Locale.US);

    static{
        httpDateFormat.setTimeZone(TimeZone.getTimeZone("GMT"));
    }

    public GoogleStorage() throws IOException
    {
        transport = setUpTransport();
    }

    private HttpTransport setUpTransport() 
    {
        HttpTransport transport = GoogleTransport.create();
        GoogleHeaders headers = (GoogleHeaders) transport.defaultHeaders;
        transport.addParser(new XmlHttpParser());
        GoogleStorageAuthentication.authorize(transport, apiKey, secret);
        return transport;
    }

    public ListBucketResult list(String bucketName) throws IOException
    {
        HttpRequest request = transport.buildGetRequest();
        request.url = new GenericUrl("http://"+bucketName+".commondatastorage.googleapis.com");
        request.headers.put("Content-Length","0");
        request.headers.put("Date",httpDateFormat.format(new Date()));
        request.headers.put("Content-Type","text/plain");
        HttpResponse response = request.execute();
        ListBucketResult bucket = response.parseAs(ListBucketResult.class);
        return bucket;
    }
}

Request & Response (from sniffer):
-------------------------------------------------------
GET / HTTP/1.1 
Accept-Encoding: gzip 
Authorization: GOOG1 GOOGXXXXXXXXXXXXXXXXXXXXXXXXXXX 
Content-Length: 0 
Content-Type: text/plain 
Date: Thu, 18 Nov 2010 22:56:16 GMT 
User-Agent: Google-API-Java-Client/1.2.1-alpha 
Host: gigyadb.commondatastorage.googleapis.com 

HTTP/1.1 403 Forbidden 
Content-Type: application/xml; charset=UTF-8 
Date: Thu, 18 Nov 2010 22:56:16 GMT 
Expires: Thu, 18 Nov 2010 22:56:16 GMT 
Cache-Control: private, max-age=0 
X-Content-Type-Options: nosniff 
X-Frame-Options: SAMEORIGIN 
X-XSS-Protection: 1; mode=block 
Content-Length: 317 
Server: GSE 
<?xml version='1.0' encoding='UTF-8'? 
><Error><Code>SignatureDoesNotMatch</Code><Message>The request 

signature we calculated does not match the signature you provided. 
Check your Google secret key and signing method.</ 
Message><StringToSign>GET 
text/plain 
Thu, 18 Nov 2010 22:56:16 GMT 
/gigyadb/</StringToSign></Error>

Original issue reported on code.google.com by street...@gmail.com on 19 Nov 2010 at 8:44

GoogleCodeExporter commented 9 years ago 
I think I found the bugs.
First, The class only writes the content-type header if content is not null. 
which is sometimes the case in GS API.
Second, it assumes that request.getRawPath() is not null and appends a "null" 
at the end of the base string.

Attached is my version that signs correctly.
It's possible of course, that I'm not using the library correctly.

Thanks,
Raviv.

Original comment by street...@gmail.com on 20 Nov 2010 at 11:14

Attachments:

GoogleCodeExporter commented 9 years ago 
Thanks for your effort Raviv.  We'll take a look at your proposed fix, do some 
testing, and hopefully release the fix as version 1.2.2.

Original comment by yan...@google.com on 14 Dec 2010 at 1:19

GoogleCodeExporter commented 9 years ago 
Started working on this issue. A couple of more issues identified with the 
signer. Two of them worth mentioning are:

/ (for ListAllMyBuckets)
GET filename (http://bucketname.commondatastorage.googleapis.com/object?acl

Original comment by api.an...@gmail.com on 15 Dec 2010 at 10:33

GoogleCodeExporter commented 9 years ago 
Problem with getRawPath() being null is fixed.  Please don't use "content-type" 
header directly and instead use an instance of HttpContent.  If the HttpContent 
of a request is null, we will assume there is no content.

Original comment by yan...@google.com on 20 Dec 2010 at 6:11

GoogleCodeExporter commented 9 years ago

Original comment by yan...@google.com on 6 Jan 2011 at 2:54

GoogleCodeExporter commented 9 years ago

Original comment by yan...@google.com on 8 Jan 2011 at 6:42