Module Tester
3 |
4 | #renderView()#
5 |
6 | "...By adding this list of headers, you tell AWS which headers in the request 290 | * are part of the signing process and which ones AWS can ignore (for example, any 291 | * additional headers added by a proxy) for purposes of validating the request."
292 | * 293 | * @requestHeaders Raw headers to be included in request 294 | * @excludeNames Names of any headers AWS should ignore for the signing process 295 | * 296 | * @return Sorted list of signed header names, delimited by semi-colon ";" 297 | */ 298 | private string function buildSignedHeaders( required struct requestHeaders, required array excludeNames ){ 299 | var name = ""; 300 | var headerNames = []; 301 | var allHeaders = !arrayLen( arguments.excludeNames ); 302 | 303 | // Identify which headers are "signed" 304 | structEach( arguments.requestHeaders, function( string name, any value ){ 305 | if ( allHeaders || !arrayFindNoCase( excludeNames, arguments.name ) ) { 306 | arrayAppend( headerNames, arguments.name ); 307 | } 308 | } ); 309 | 310 | // Sort header names in ASCII order 311 | arraySort( headerNames, "text", "asc" ); 312 | 313 | // Return list of names 314 | return arrayToList( headerNames, ";" ); 315 | } 316 | 317 | /** 318 | * Generates a list of canonical headers 319 | * 320 | * @requestHeaders Structure containing headers to be included in request hash 321 | * 322 | * @return Sorted list of header pairs, delimited by new lines 323 | */ 324 | private string function buildCanonicalHeaders( required struct requestHeaders ){ 325 | var pairs = ""; 326 | var names = ""; 327 | var headers = ""; 328 | 329 | // Scrub the header names and values first 330 | headers = cleanHeaders( arguments.requestHeaders ); 331 | 332 | // Sort header names in ASCII order 333 | names = structKeyArray( headers ); 334 | arraySort( names, "text", "asc" ); 335 | 336 | // Build array of sorted header name and value pairs 337 | pairs = []; 338 | arrayEach( names, function( string key ){ 339 | arrayAppend( pairs, arguments.key & ":" & headers[ arguments.key ] ); 340 | } ); 341 | 342 | // Generate list. Note: List must END WITH a new line character 343 | return arrayToList( pairs, chr( 10 ) ) & chr( 10 ); 344 | } 345 | 346 | 347 | /** 348 | * Generates canonical URI. Encoded, absolute path component of the URI, 349 | * which is everything in the URI from the HTTP host to the question mark character ("?") 350 | * that begins the query string parameters (if any) 351 | * 352 | * @uriPath URI or path. If empty, "/" will be used 353 | * 354 | * @return URL encoded path 355 | */ 356 | public string function buildCanonicalURI( required string requestURI ){ 357 | var path = arguments.requestURI; 358 | // Return "/" for empty path 359 | if ( !len( trim( path ) ) ) { 360 | path = "/"; 361 | } 362 | 363 | // Convert to absolute path (if needed) 364 | if ( left( path, 1 ) != "/" ) { 365 | path = "/" & path; 366 | } 367 | 368 | return urlEncodePath( path ); 369 | } 370 | 371 | 372 | /** 373 | * Generates signing key for AWS Signature V4 374 | * 375 | *Source: http://stackoverflow.com/questions/32513197/how-to-derive-a-sign-in-key-for-aws-signature-version-4-in-coldfusion
376 | * 377 | * @dateStamp Date stamp in yyyymmdd format. Example: 20150830 378 | * @regionName Region name that is part of the service's endpoint (alphanumeric). Example: "us-east-1" 379 | * @serviceName Service name that is part of the service's endpoint (alphanumeric). Example: "s3" 380 | * @algorithm HMAC algorithm. Default is "HMACSHA256" 381 | * 382 | * @return signing key in binary 383 | */ 384 | private binary function generateSignatureKey( 385 | required string dateStamp, 386 | required string regionName, 387 | required string serviceName, 388 | required string secretKey, 389 | string algorithm = "HMACSHA256" 390 | ){ 391 | var kSecret = charsetDecode( "AWS4" & arguments.secretKey, "UTF-8" ); 392 | var kDate = hmacBinary( arguments.dateStamp, kSecret ); 393 | // Region information as a lowercase alphanumeric string 394 | var kRegion = hmacBinary( lCase( arguments.regionName ), kDate ); 395 | // Service name information as a lowercase alphanumeric string 396 | var kService = hmacBinary( lCase( arguments.serviceName ), kRegion ); 397 | // A special termination string: aws4_request 398 | var kSigning = hmacBinary( "aws4_request", kService ); 399 | 400 | return kSigning; 401 | } 402 | 403 | 404 | /** 405 | * Generates string indicating the scope for which the signature is valid. Credential scope 406 | * is represented by a slash-separated string of dimensions in the following order: 407 | * 408 | * dateStamp / regionName / serviceName / terminationString 409 | * 410 | * @dateStamp - Current date in UTC (must be same as X-Amz-Date date). Format yyyyMMdd 411 | * @regionName - Name of the target region, UTF-8 encoded. Example "us-east-1" 412 | * @serviceName - Name of the target service, UTF-8 encoded. Example "s3" 413 | * 414 | * @return - formatted string. Example: 20150830/us-east-1/iam/aws4_request 415 | */ 416 | private string function buildCredentialScope( 417 | required string dateStamp, 418 | required string regionName, 419 | required string serviceName 420 | ){ 421 | return arguments.dateStamp & "/" & lCase( arguments.regionName ) & "/" & lCase( arguments.serviceName ) & "/" & "aws4_request"; 422 | } 423 | 424 | /** 425 | * Generates Authorization header string. 426 | * 427 | * Format: algorithm + ' ' + 'Credential=' + access_key + '/' + credential_scope 428 | * + ', ' + 'SignedHeaders=' + signed_headers + ', ' 429 | * + 'Signature=' + signature 430 | * 431 | * @dateStamp - Current date in UTC (must be same as X-Amz-Date date). Format yyyyMMdd 432 | * @regionName - Name of the target region, UTF-8 encoded. Example "us-east-1" 433 | * @serviceName - Name of the target service, UTF-8 encoded. Example "s3" 434 | * 435 | * @return - formatted string. Example: 20150830/us-east-1/iam/aws4_request 436 | */ 437 | private string function buildAuthorizationHeader( 438 | required struct requestHeaders, 439 | required string signedHeaders, 440 | required string credentialScope, 441 | required string signature, 442 | required string accessKey 443 | ){ 444 | var authHeader = variables.signatureAlgorithm & " " 445 | & "Credential=" & arguments.accessKey & "/" & arguments.credentialScope & "," 446 | & "SignedHeaders=" & arguments.signedHeaders & "," 447 | & "Signature=" & arguments.signature; 448 | 449 | 450 | return authHeader; 451 | } 452 | 453 | 454 | /** 455 | * Convenience method which generates a (binary) HMAC code for the specified message 456 | * 457 | * @message Message to sign 458 | * @key HMAC key in binary form 459 | * @algorithm Signing algorithm. [ Default is "HMACSHA256" ] 460 | * @encoding Character encoding of message string. [ Default is UTF-8 ] 461 | * 462 | * @return HMAC value for the specified message as binary (currently unsupported in CF11) 463 | */ 464 | private binary function hmacBinary( 465 | required string message, 466 | required binary key, 467 | string algorithm = "HMACSHA256", 468 | string encoding = "UTF-8" 469 | ){ 470 | // Generate HMAC and decode result into binary 471 | return binaryDecode( 472 | hmac( 473 | arguments.message, 474 | arguments.key, 475 | arguments.algorithm, 476 | arguments.encoding 477 | ), 478 | "hex" 479 | ); 480 | } 481 | 482 | 483 | /** 484 | * Convenience method that hashes the supplied value, with SHA256 485 | * 486 | * @text value to hash 487 | * 488 | * @return hashed value, in lower case 489 | */ 490 | private string function hash256( required any text ){ 491 | return lCase( hash( arguments.text, "SHA-256" ) ); 492 | } 493 | 494 | 495 | /** 496 | * URL encode query parameters and names 497 | * 498 | * @params Structure containing all query parameters for the request 499 | * 500 | * @return new structure with all parameter names and values encoded 501 | */ 502 | private struct function encodeQueryParams( required struct queryParams ){ 503 | // First encode parameter names and values 504 | var encodedParams = {}; 505 | structEach( arguments.queryParams, function( string key, string value ){ 506 | encodedParams[ urlEncodeForAWS( arguments.key ) ] = urlEncodeForAWS( arguments.value ); 507 | } ); 508 | return encodedParams; 509 | } 510 | 511 | /** 512 | * Scrubs header names and values: 513 | *
69 |