aws4.js 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373
  1. var aws4 = exports,
  2. url = require('url'),
  3. querystring = require('querystring'),
  4. crypto = require('crypto'),
  5. lru = require('./lru'),
  6. credentialsCache = lru(1000)
  7. // http://docs.amazonwebservices.com/general/latest/gr/signature-version-4.html
  8. function hmac(key, string, encoding) {
  9. return crypto.createHmac('sha256', key).update(string, 'utf8').digest(encoding)
  10. }
  11. function hash(string, encoding) {
  12. return crypto.createHash('sha256').update(string, 'utf8').digest(encoding)
  13. }
  14. // This function assumes the string has already been percent encoded
  15. function encodeRfc3986(urlEncodedString) {
  16. return urlEncodedString.replace(/[!'()*]/g, function(c) {
  17. return '%' + c.charCodeAt(0).toString(16).toUpperCase()
  18. })
  19. }
  20. function encodeRfc3986Full(str) {
  21. return encodeRfc3986(encodeURIComponent(str))
  22. }
  23. // A bit of a combination of:
  24. // https://github.com/aws/aws-sdk-java-v2/blob/dc695de6ab49ad03934e1b02e7263abbd2354be0/core/auth/src/main/java/software/amazon/awssdk/auth/signer/internal/AbstractAws4Signer.java#L59
  25. // https://github.com/aws/aws-sdk-js/blob/18cb7e5b463b46239f9fdd4a65e2ff8c81831e8f/lib/signers/v4.js#L191-L199
  26. // https://github.com/mhart/aws4fetch/blob/b3aed16b6f17384cf36ea33bcba3c1e9f3bdfefd/src/main.js#L25-L34
  27. var HEADERS_TO_IGNORE = {
  28. 'authorization': true,
  29. 'connection': true,
  30. 'x-amzn-trace-id': true,
  31. 'user-agent': true,
  32. 'expect': true,
  33. 'presigned-expires': true,
  34. 'range': true,
  35. }
  36. // request: { path | body, [host], [method], [headers], [service], [region] }
  37. // credentials: { accessKeyId, secretAccessKey, [sessionToken] }
  38. function RequestSigner(request, credentials) {
  39. if (typeof request === 'string') request = url.parse(request)
  40. var headers = request.headers = (request.headers || {}),
  41. hostParts = (!this.service || !this.region) && this.matchHost(request.hostname || request.host || headers.Host || headers.host)
  42. this.request = request
  43. this.credentials = credentials || this.defaultCredentials()
  44. this.service = request.service || hostParts[0] || ''
  45. this.region = request.region || hostParts[1] || 'us-east-1'
  46. // SES uses a different domain from the service name
  47. if (this.service === 'email') this.service = 'ses'
  48. if (!request.method && request.body)
  49. request.method = 'POST'
  50. if (!headers.Host && !headers.host) {
  51. headers.Host = request.hostname || request.host || this.createHost()
  52. // If a port is specified explicitly, use it as is
  53. if (request.port)
  54. headers.Host += ':' + request.port
  55. }
  56. if (!request.hostname && !request.host)
  57. request.hostname = headers.Host || headers.host
  58. this.isCodeCommitGit = this.service === 'codecommit' && request.method === 'GIT'
  59. }
  60. RequestSigner.prototype.matchHost = function(host) {
  61. var match = (host || '').match(/([^\.]+)\.(?:([^\.]*)\.)?amazonaws\.com(\.cn)?$/)
  62. var hostParts = (match || []).slice(1, 3)
  63. // ES's hostParts are sometimes the other way round, if the value that is expected
  64. // to be region equals ‘es’ switch them back
  65. // e.g. search-cluster-name-aaaa00aaaa0aaa0aaaaaaa0aaa.us-east-1.es.amazonaws.com
  66. if (hostParts[1] === 'es')
  67. hostParts = hostParts.reverse()
  68. if (hostParts[1] == 's3') {
  69. hostParts[0] = 's3'
  70. hostParts[1] = 'us-east-1'
  71. } else {
  72. for (var i = 0; i < 2; i++) {
  73. if (/^s3-/.test(hostParts[i])) {
  74. hostParts[1] = hostParts[i].slice(3)
  75. hostParts[0] = 's3'
  76. break
  77. }
  78. }
  79. }
  80. return hostParts
  81. }
  82. // http://docs.aws.amazon.com/general/latest/gr/rande.html
  83. RequestSigner.prototype.isSingleRegion = function() {
  84. // Special case for S3 and SimpleDB in us-east-1
  85. if (['s3', 'sdb'].indexOf(this.service) >= 0 && this.region === 'us-east-1') return true
  86. return ['cloudfront', 'ls', 'route53', 'iam', 'importexport', 'sts']
  87. .indexOf(this.service) >= 0
  88. }
  89. RequestSigner.prototype.createHost = function() {
  90. var region = this.isSingleRegion() ? '' : '.' + this.region,
  91. subdomain = this.service === 'ses' ? 'email' : this.service
  92. return subdomain + region + '.amazonaws.com'
  93. }
  94. RequestSigner.prototype.prepareRequest = function() {
  95. this.parsePath()
  96. var request = this.request, headers = request.headers, query
  97. if (request.signQuery) {
  98. this.parsedPath.query = query = this.parsedPath.query || {}
  99. if (this.credentials.sessionToken)
  100. query['X-Amz-Security-Token'] = this.credentials.sessionToken
  101. if (this.service === 's3' && !query['X-Amz-Expires'])
  102. query['X-Amz-Expires'] = 86400
  103. if (query['X-Amz-Date'])
  104. this.datetime = query['X-Amz-Date']
  105. else
  106. query['X-Amz-Date'] = this.getDateTime()
  107. query['X-Amz-Algorithm'] = 'AWS4-HMAC-SHA256'
  108. query['X-Amz-Credential'] = this.credentials.accessKeyId + '/' + this.credentialString()
  109. query['X-Amz-SignedHeaders'] = this.signedHeaders()
  110. } else {
  111. if (!request.doNotModifyHeaders && !this.isCodeCommitGit) {
  112. if (request.body && !headers['Content-Type'] && !headers['content-type'])
  113. headers['Content-Type'] = 'application/x-www-form-urlencoded; charset=utf-8'
  114. if (request.body && !headers['Content-Length'] && !headers['content-length'])
  115. headers['Content-Length'] = Buffer.byteLength(request.body)
  116. if (this.credentials.sessionToken && !headers['X-Amz-Security-Token'] && !headers['x-amz-security-token'])
  117. headers['X-Amz-Security-Token'] = this.credentials.sessionToken
  118. if (this.service === 's3' && !headers['X-Amz-Content-Sha256'] && !headers['x-amz-content-sha256'])
  119. headers['X-Amz-Content-Sha256'] = hash(this.request.body || '', 'hex')
  120. if (headers['X-Amz-Date'] || headers['x-amz-date'])
  121. this.datetime = headers['X-Amz-Date'] || headers['x-amz-date']
  122. else
  123. headers['X-Amz-Date'] = this.getDateTime()
  124. }
  125. delete headers.Authorization
  126. delete headers.authorization
  127. }
  128. }
  129. RequestSigner.prototype.sign = function() {
  130. if (!this.parsedPath) this.prepareRequest()
  131. if (this.request.signQuery) {
  132. this.parsedPath.query['X-Amz-Signature'] = this.signature()
  133. } else {
  134. this.request.headers.Authorization = this.authHeader()
  135. }
  136. this.request.path = this.formatPath()
  137. return this.request
  138. }
  139. RequestSigner.prototype.getDateTime = function() {
  140. if (!this.datetime) {
  141. var headers = this.request.headers,
  142. date = new Date(headers.Date || headers.date || new Date)
  143. this.datetime = date.toISOString().replace(/[:\-]|\.\d{3}/g, '')
  144. // Remove the trailing 'Z' on the timestamp string for CodeCommit git access
  145. if (this.isCodeCommitGit) this.datetime = this.datetime.slice(0, -1)
  146. }
  147. return this.datetime
  148. }
  149. RequestSigner.prototype.getDate = function() {
  150. return this.getDateTime().substr(0, 8)
  151. }
  152. RequestSigner.prototype.authHeader = function() {
  153. return [
  154. 'AWS4-HMAC-SHA256 Credential=' + this.credentials.accessKeyId + '/' + this.credentialString(),
  155. 'SignedHeaders=' + this.signedHeaders(),
  156. 'Signature=' + this.signature(),
  157. ].join(', ')
  158. }
  159. RequestSigner.prototype.signature = function() {
  160. var date = this.getDate(),
  161. cacheKey = [this.credentials.secretAccessKey, date, this.region, this.service].join(),
  162. kDate, kRegion, kService, kCredentials = credentialsCache.get(cacheKey)
  163. if (!kCredentials) {
  164. kDate = hmac('AWS4' + this.credentials.secretAccessKey, date)
  165. kRegion = hmac(kDate, this.region)
  166. kService = hmac(kRegion, this.service)
  167. kCredentials = hmac(kService, 'aws4_request')
  168. credentialsCache.set(cacheKey, kCredentials)
  169. }
  170. return hmac(kCredentials, this.stringToSign(), 'hex')
  171. }
  172. RequestSigner.prototype.stringToSign = function() {
  173. return [
  174. 'AWS4-HMAC-SHA256',
  175. this.getDateTime(),
  176. this.credentialString(),
  177. hash(this.canonicalString(), 'hex'),
  178. ].join('\n')
  179. }
  180. RequestSigner.prototype.canonicalString = function() {
  181. if (!this.parsedPath) this.prepareRequest()
  182. var pathStr = this.parsedPath.path,
  183. query = this.parsedPath.query,
  184. headers = this.request.headers,
  185. queryStr = '',
  186. normalizePath = this.service !== 's3',
  187. decodePath = this.service === 's3' || this.request.doNotEncodePath,
  188. decodeSlashesInPath = this.service === 's3',
  189. firstValOnly = this.service === 's3',
  190. bodyHash
  191. if (this.service === 's3' && this.request.signQuery) {
  192. bodyHash = 'UNSIGNED-PAYLOAD'
  193. } else if (this.isCodeCommitGit) {
  194. bodyHash = ''
  195. } else {
  196. bodyHash = headers['X-Amz-Content-Sha256'] || headers['x-amz-content-sha256'] ||
  197. hash(this.request.body || '', 'hex')
  198. }
  199. if (query) {
  200. var reducedQuery = Object.keys(query).reduce(function(obj, key) {
  201. if (!key) return obj
  202. obj[encodeRfc3986Full(key)] = !Array.isArray(query[key]) ? query[key] :
  203. (firstValOnly ? query[key][0] : query[key])
  204. return obj
  205. }, {})
  206. var encodedQueryPieces = []
  207. Object.keys(reducedQuery).sort().forEach(function(key) {
  208. if (!Array.isArray(reducedQuery[key])) {
  209. encodedQueryPieces.push(key + '=' + encodeRfc3986Full(reducedQuery[key]))
  210. } else {
  211. reducedQuery[key].map(encodeRfc3986Full).sort()
  212. .forEach(function(val) { encodedQueryPieces.push(key + '=' + val) })
  213. }
  214. })
  215. queryStr = encodedQueryPieces.join('&')
  216. }
  217. if (pathStr !== '/') {
  218. if (normalizePath) pathStr = pathStr.replace(/\/{2,}/g, '/')
  219. pathStr = pathStr.split('/').reduce(function(path, piece) {
  220. if (normalizePath && piece === '..') {
  221. path.pop()
  222. } else if (!normalizePath || piece !== '.') {
  223. if (decodePath) piece = decodeURIComponent(piece.replace(/\+/g, ' '))
  224. path.push(encodeRfc3986Full(piece))
  225. }
  226. return path
  227. }, []).join('/')
  228. if (pathStr[0] !== '/') pathStr = '/' + pathStr
  229. if (decodeSlashesInPath) pathStr = pathStr.replace(/%2F/g, '/')
  230. }
  231. return [
  232. this.request.method || 'GET',
  233. pathStr,
  234. queryStr,
  235. this.canonicalHeaders() + '\n',
  236. this.signedHeaders(),
  237. bodyHash,
  238. ].join('\n')
  239. }
  240. RequestSigner.prototype.canonicalHeaders = function() {
  241. var headers = this.request.headers
  242. function trimAll(header) {
  243. return header.toString().trim().replace(/\s+/g, ' ')
  244. }
  245. return Object.keys(headers)
  246. .filter(function(key) { return HEADERS_TO_IGNORE[key.toLowerCase()] == null })
  247. .sort(function(a, b) { return a.toLowerCase() < b.toLowerCase() ? -1 : 1 })
  248. .map(function(key) { return key.toLowerCase() + ':' + trimAll(headers[key]) })
  249. .join('\n')
  250. }
  251. RequestSigner.prototype.signedHeaders = function() {
  252. return Object.keys(this.request.headers)
  253. .map(function(key) { return key.toLowerCase() })
  254. .filter(function(key) { return HEADERS_TO_IGNORE[key] == null })
  255. .sort()
  256. .join(';')
  257. }
  258. RequestSigner.prototype.credentialString = function() {
  259. return [
  260. this.getDate(),
  261. this.region,
  262. this.service,
  263. 'aws4_request',
  264. ].join('/')
  265. }
  266. RequestSigner.prototype.defaultCredentials = function() {
  267. var env = process.env
  268. return {
  269. accessKeyId: env.AWS_ACCESS_KEY_ID || env.AWS_ACCESS_KEY,
  270. secretAccessKey: env.AWS_SECRET_ACCESS_KEY || env.AWS_SECRET_KEY,
  271. sessionToken: env.AWS_SESSION_TOKEN,
  272. }
  273. }
  274. RequestSigner.prototype.parsePath = function() {
  275. var path = this.request.path || '/'
  276. // S3 doesn't always encode characters > 127 correctly and
  277. // all services don't encode characters > 255 correctly
  278. // So if there are non-reserved chars (and it's not already all % encoded), just encode them all
  279. if (/[^0-9A-Za-z;,/?:@&=+$\-_.!~*'()#%]/.test(path)) {
  280. path = encodeURI(decodeURI(path))
  281. }
  282. var queryIx = path.indexOf('?'),
  283. query = null
  284. if (queryIx >= 0) {
  285. query = querystring.parse(path.slice(queryIx + 1))
  286. path = path.slice(0, queryIx)
  287. }
  288. this.parsedPath = {
  289. path: path,
  290. query: query,
  291. }
  292. }
  293. RequestSigner.prototype.formatPath = function() {
  294. var path = this.parsedPath.path,
  295. query = this.parsedPath.query
  296. if (!query) return path
  297. // Services don't support empty query string keys
  298. if (query[''] != null) delete query['']
  299. return path + '?' + encodeRfc3986(querystring.stringify(query))
  300. }
  301. aws4.RequestSigner = RequestSigner
  302. aws4.sign = function(request, credentials) {
  303. return new RequestSigner(request, credentials).sign()
  304. }