Skip to content

Commit 0fa7b69

Browse files
carsonxucarsonxu
committed
修改签名方式，保证安全性
1 parent 2dac011 commit 0fa7b69

22 files changed

+6152
-4947
lines changed

‎demo/demo.js

Lines changed: 47 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,20 +19,58 @@ var util = {
1919

2020
var getAuthorization = function (options, callback) {
2121

22-
// 方法一（推荐）
22+
// 方法一、后端计算签名（推荐）
2323
var method = (options.Method || 'get').toLowerCase();
2424
var key = options.Key || '';
25+
var query = options.Query || {};
26+
var headers = options.Headers || {};
2527
var pathname = key.indexOf('/') === 0 ? key : '/' + key;
26-
27-
var url = '../server/auth.php?method=' + method + '&pathname=' + encodeURIComponent(pathname);
28+
// var url = 'http://127.0.0.1:3000/auth';
29+
var url = '../server/auth.php';
2830
var xhr = new XMLHttpRequest();
29-
xhr.open('GET', url, true);
31+
var data = {
32+
method: method,
33+
pathname: pathname,
34+
query: query,
35+
headers: headers,
36+
};
37+
xhr.open('POST', url, true);
38+
xhr.setRequestHeader('content-type', 'application/json');
3039
xhr.onload = function (e) {
3140
callback(e.target.responseText);
3241
};
33-
xhr.send();
34-
35-
// // 方法二（适用于前端调试）
42+
xhr.send(JSON.stringify(data));
43+
44+
// // 方法二、后端通过获取临时密钥，计算签名给到前端（适用于前端调试）
45+
// var method = (options.Method || 'get').toLowerCase();
46+
// var key = options.Key || '';
47+
// var query = options.Query || {};
48+
// var headers = options.Headers || {};
49+
// var pathname = key.indexOf('/') === 0 ? key : '/' + key;
50+
// // var url = 'http://127.0.0.1:3000/sts';
51+
// var url = '../server/sts.php';
52+
// var xhr = new XMLHttpRequest();
53+
// var data = {
54+
// method: method,
55+
// pathname: pathname,
56+
// query: query,
57+
// headers: headers,
58+
// };
59+
// xhr.open('POST', url, true);
60+
// xhr.setRequestHeader('content-type', 'application/json');
61+
// xhr.onload = function (e) {
62+
// try {
63+
// var AuthData = JSON.parse(e.target.responseText);
64+
// } catch (e) {
65+
// }
66+
// callback({
67+
// Authorization: AuthData.authorization,
68+
// XCosSecurityToken: AuthData.sessionToken,
69+
// });
70+
// };
71+
// xhr.send(JSON.stringify(data));
72+
73+
// // 方法三、前端计算签名（适用于前端调试）
3674
// var authorization = COS.getAuthorization({
3775
// SecretId: 'AKIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
3876
// SecretKey: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
@@ -52,14 +90,8 @@ var getSTS = function (params, callback) {
5290
};
5391

5492
var cos = new COS({
55-
// 必选参数
5693
getAuthorization: getAuthorization,
57-
// getSTS: getSTS, // 支持使用临时密钥
58-
// 可选参数
59-
FileParallelLimit: 3, // 控制文件上传并发数
60-
ChunkParallelLimit: 3, // 控制单个文件下分片上传并发数
61-
ChunkSize: 1024 * 1024, // 控制分片大小，单位 B
62-
ProgressInterval: 1000, // 控制 onProgress 回调的间隔
94+
// getSTS: getSTS,
6395
});
6496
var TaskId;
6597

@@ -572,7 +604,7 @@ function abortUploadTask() {
572604
}
573605

574606
function sliceUploadFile() {
575-
var blob = util.createFile({size: 1024 * 1024 * 30});
607+
var blob = util.createFile({size: 1024 * 1024 * 2});
576608
cos.sliceUploadFile({
577609
Bucket: config.Bucket, // Bucket 格式：test-1250000000
578610
Region: config.Region,

‎demo/simple-form.html

Lines changed: 0 additions & 99 deletions
This file was deleted.

‎demo/simple-put.html

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -34,35 +34,33 @@ <h1>Ajax Put 上传</h1>
3434

3535
// 计算签名
3636
var getAuthorization = function (options, callback) {
37-
// 方法一（适用于前端调试）
3837
var method = (options.Method || 'get').toLowerCase();
3938
var key = options.Key || '';
4039
var pathname = key.indexOf('/') === 0 ? key : '/' + key;
41-
var url = '../server/auth.php?method=' + method + '&pathname=' + encodeURIComponent(pathname);
40+
41+
var url = '../server/auth.php';
4242
var xhr = new XMLHttpRequest();
43-
xhr.open('GET', url, true);
44-
xhr.onload = function (e) {
45-
callback(null, e.target.responseText);
43+
var data = {
44+
method: method,
45+
pathname: pathname,
4646
};
47-
xhr.onerror = function (e) {
48-
callback('获取签名出错');
47+
xhr.open('POST', url, true);
48+
xhr.setRequestHeader('content-type', 'application/json');
49+
xhr.onload = function (e) {
50+
if (e.target.responseText === 'action deny') {
51+
alert('action deny');
52+
} else {
53+
callback(e.target.responseText);
54+
}
4955
};
50-
xhr.send();
51-
52-
// // 方法二（适用于前端调试），需要引入../dist/cos-js-sdk-v5.min.js
53-
// var authorization = COS.getAuthorization({
54-
// SecretId: SecretId,
55-
// SecretKey: SecretKey,
56-
// Method: options.Method,
57-
// Key: options.Key,
58-
// });
59-
// callback(null, authorization);
56+
xhr.send(JSON.stringify(data));
6057
};
6158

6259
// 上传文件
6360
var uploadFile = function (file, callback) {
64-
var Key = file.name;
65-
getAuthorization({Method: 'PUT', Key: Key}, function (err, auth) {
61+
var Key = 'dir/' + file.name; // 这里指定上传目录和文件名
62+
getAuthorization({Method: 'PUT', Key: Key}, function (auth) {
63+
6664
var url = prefix + Key;
6765
var xhr = new XMLHttpRequest();
6866
xhr.open('PUT', url, true);

‎demo/sts-form.html

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ <h1>Form 表单简单上传（兼容 IE8）</h1>
1616
<input id="success_action_redirect" name="success_action_redirect" type="hidden" value="">
1717
<input id="key" name="key" type="hidden" value="">
1818
<input id="Signature" name="Signature" type="hidden" value="">
19+
<input id="x-cos-security-token" name="x-cos-security-token" type="hidden" value="">
1920
<input id="fileSelector" name="file" type="file">
2021
<input id="submitBtn" type="button" value="提交">
2122
</form>
@@ -38,8 +39,11 @@ <h1>Form 表单简单上传（兼容 IE8）</h1>
3839
var getAuthorization = function (options, callback) {
3940
var method = (options.Method || 'get').toLowerCase();
4041
var key = options.Key || '';
41-
var pathname = key.indexOf('/') === 0 ? key : '/' + key;
42-
var url = '../server/sts.php?method=' + method + '&pathname=' + encodeURIComponent(pathname);
42+
// var url = 'http://127.0.0.1:3000/sts-post-object' +
43+
var url = '../server/sts-post-object.php' +
44+
'?method=' + method +
45+
'&pathname=' + encodeURIComponent('/') +
46+
'&key=' + encodeURIComponent(key);
4347
var xhr = new XMLHttpRequest();
4448
xhr.open('GET', url, true);
4549
xhr.onreadystatechange = function (e) {
@@ -48,7 +52,7 @@ <h1>Form 表单简单上传（兼容 IE8）</h1>
4852
var data = JSON.parse(xhr.responseText);
4953
callback(null, {
5054
Authorization: data.authorization,
51-
XCosSecurityToken: data.credentials.sessionToken,
55+
XCosSecurityToken: data.sessionToken,
5256
});
5357
} else {
5458
callback('获取签名出错');
@@ -91,12 +95,13 @@ <h1>Form 表单简单上传（兼容 IE8）</h1>
9195
document.getElementById('msg').innerText = '未选择上传文件';
9296
return;
9397
}
94-
Key = filePath.match(/[\\\/]?([^\\\/]+)$/)[1];
95-
getAuthorization({Method: 'POST', Key: '/'}, function (err, auth) {
98+
Key = 'dir/' + filePath.match(/[\\\/]?([^\\\/]+)$/)[1]; // 这里指定上传目录和文件名
99+
getAuthorization({Method: 'POST', Key: Key}, function (err, AuthData) {
96100
// 在当前目录下放一个空的 empty.html 以便让接口上传完成跳转回来
97101
document.getElementById('success_action_redirect').value = location.href.substr(0, location.href.lastIndexOf('/') + 1) + 'empty.html';
98102
document.getElementById('key').value = Key;
99-
document.getElementById('Signature').value = auth;
103+
document.getElementById('Signature').value = AuthData.Authorization;
104+
document.getElementById('x-cos-security-token').value = AuthData.XCosSecurityToken;
100105
form.submit();
101106
});
102107
};

‎demo/sts-post.html

Lines changed: 15 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -26,76 +26,56 @@ <h1>Ajax Post 上传</h1>
2626
<script>
2727
(function () {
2828
// 请求用到的参数
29-
var Bucket = 'test-125000000';
29+
var Bucket = 'test-1250000000';
3030
var Region = 'ap-guangzhou';
3131
var protocol = location.protocol === 'https:' ? 'https:' : 'http:';
3232
var prefix = protocol + '//' + Bucket + '.cos.' + Region + '.myqcloud.com/';
3333

3434
// 计算签名
3535
var getAuthorization = function (options, callback) {
36-
// 方法一（适用于前端调试）
3736
var method = (options.Method || 'get').toLowerCase();
3837
var key = options.Key || '';
39-
var pathname = key.indexOf('/') === 0 ? key : '/' + key;
40-
var url = '../server/sts.php?method=' + method + '&pathname=' + encodeURIComponent(pathname);
38+
// var url = 'http://127.0.0.1:3000/sts-post-object' +
39+
var url = '../server/sts-post-object.php' +
40+
'?method=' + method +
41+
'&pathname=' + encodeURIComponent('/') +
42+
'&key=' + encodeURIComponent(key);
4143
var xhr = new XMLHttpRequest();
4244
xhr.open('GET', url, true);
4345
xhr.onload = function (e) {
4446
var data = JSON.parse(e.target.responseText);
47+
if (data.authorization === '') {
48+
49+
}
4550
callback(null, {
4651
Authorization: data.authorization,
47-
XCosSecurityToken: data.credentials.sessionToken,
52+
XCosSecurityToken: data.sessionToken,
4853
});
4954
};
5055
xhr.onerror = function (e) {
5156
callback('获取签名出错');
5257
};
5358
xhr.send();
54-
55-
// // 方法二（适用于前端调试）
56-
// var method = (options.Method || 'get').toLowerCase();
57-
// var key = options.Key || '';
58-
// var pathname = key.indexOf('/') === 0 ? key : '/' + key;
59-
// var url = '../server/key.php?method=' + method + '&pathname=' + encodeURIComponent(pathname);
60-
// var xhr = new XMLHttpRequest();
61-
// xhr.open('GET', url, true);
62-
// xhr.onload = function (e) {
63-
// var data = JSON.parse(e.target.responseText);
64-
// var authorization = COS.getAuthorization({
65-
// SecretId: data.credentials.tmpSecretId,
66-
// SecretKey: data.credentials.tmpSecretKey,
67-
// Method: options.Method,
68-
// Key: options.Key,
69-
// });
70-
// callback(null, {
71-
// Authorization: authorization,
72-
// XCosSecurityToken: data.credentials.sessionToken,
73-
// });
74-
// };
75-
// xhr.onerror = function (e) {
76-
// callback('获取签名出错');
77-
// };
78-
// xhr.send();
7959
};
8060

8161
// 上传文件
8262
var uploadFile = function (file, callback) {
83-
var Key = file.name;
63+
var Key = 'dir/' + file.name; // 这里指定上传目录和文件名
8464

85-
getAuthorization({Method: 'POST', Key: ''}, function (err, info) {
65+
getAuthorization({Method: 'POST', Key: Key}, function (err, info) {
8666
var auth = info.Authorization;
8767
var XCosSecurityToken = info.XCosSecurityToken;
68+
8869
var fd = new FormData();
8970
fd.append('key', Key);
9071
fd.append('Signature', auth);
9172
XCosSecurityToken && fd.append('x-cos-security-token', XCosSecurityToken);
9273
fd.append('file', file);
93-
9474
var url = prefix;
9575
var xhr = new XMLHttpRequest();
9676
xhr.open('POST', url, true);
9777
xhr.onload = function () {
98-
if (xhr.status === 200 || xhr.status === 206) {
78+
if (Math.floor(xhr.status / 100) === 2) {
9979
var ETag = xhr.getResponseHeader('etag');
10080
callback(null, {url: url, ETag: ETag});
10181
} else {
@@ -106,6 +86,7 @@ <h1>Ajax Post 上传</h1>
10686
callback('文件 ' + Key + ' 上传失败，请检查是否没配置 CORS 跨域规则');
10787
};
10888
xhr.send(fd);
89+
10990
});
11091
};
11192

0 commit comments

Comments
 (0)