用python3作为客户端使用Kong的HMac认证功能


今天使用 python3 写客户端试验了一下 Kong 的 HMac 认证功能,中间遇到几个小坑,分享一下

BaiduShurufa_2018-11-21_16-57-52.png

Kong这个 Api Gateway 还是很成熟的,这些坑到最后其实都是自己的错

官方文档在这里https://docs.konghq.com/hub/kong-inc/hmac-auth/

源代码如下,重点避坑指南在注释里:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import datetime

__author__ = 'ChangYi'

import urllib
import requests
import base64
import email.utils
import hmac
import hashlib

if __name__ == "__main__":
    url = "http://172.16.0.21:38000/getlist"
    secret = b"nOc0YO0GuKuvJjhCZdgIVMHeWKJg93a5"
    data = [('appkey', '6044344985872289337'),
            ('format', 'json'),
            ('v', '2.0'),
            ('offset', '0'),
            ('num', '100'),
            ('test', "中文")
            ]
    #由于用了requests,就得提前做一下body,然后sha256,再base64,制作内容校验码Digest
    body = urllib.parse.urlencode(data).encode()
    print(body)
    digest = hashlib.sha256(body).digest()
    base64_digest = base64.standard_b64encode(digest).decode()
    Digest = "SHA-256=" + base64_digest

    user = "AAA"
    date = email.utils.format_datetime(
        datetime.datetime.now(datetime.timezone.utc), #第一个重点在这里,一定要用UTC制作时间戳
        True)
    #第二个重点,拼接signing_string一定要用  "key: value\n"的形式拼接,key全小写,冒号后面必须有一个空格
    signing_string = f"x-date: {date}\nPOST /getlist HTTP/1.1\ndigest: {Digest}"
    print(signing_string)
    hash = hmac.new(secret, signing_string.encode(), digestmod='SHA256').digest() #第三个重点在这里,一定要不要用hexdigest()
    sign = base64.standard_b64encode(hash).decode()
    authstr = f'hmac username="{user}", algorithm="hmac-sha256", headers="x-date request-line digest", signature="{sign}"'
    print("authstr = " + authstr)
    headers = {  # "Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
        "Host": "abc.abc.com",
        "x-date": date,
        "digest": Digest,#由于配置了内容校验码Digest,这一项必须有
        "Authorization": authstr
    }
    print(requests.post(url, data=data, headers=headers).text)