Table of Contents

Class AWS4Signer

Namespace
Amazon.Runtime.Internal.Auth
Assembly
AWSSDK.Core.dll

AWS4 protocol signer for service calls that transmit authorization in the header field "Authorization".

public class AWS4Signer : AbstractAWSSigner
Inheritance
AWS4Signer
Derived
Inherited Members

Constructors

AWS4Signer() 

public AWS4Signer()

AWS4Signer(bool) 

public AWS4Signer(bool signPayload)

Parameters

signPayload bool

Fields

AWS4AlgorithmTag 

public const string AWS4AlgorithmTag = "AWS4-HMAC-SHA256"

Field Value

string

AWS4aAlgorithmTag 

public const string AWS4aAlgorithmTag = "AWS4-ECDSA-P256-SHA256"

Field Value

string

AWSChunkedEncoding 

public const string AWSChunkedEncoding = "aws-chunked"

Field Value

string

Algorithm 

public const string Algorithm = "HMAC-SHA256"

Field Value

string

Credential 

public const string Credential = "Credential"

Field Value

string

EmptyBodySha256 

public const string EmptyBodySha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

Field Value

string

Scheme 

public const string Scheme = "AWS4"

Field Value

string

Signature 

public const string Signature = "Signature"

Field Value

string

SignedHeaders 

public const string SignedHeaders = "SignedHeaders"

Field Value

string

Sigv4aAlgorithm 

public const string Sigv4aAlgorithm = "ECDSA-P256-SHA256"

Field Value

string

StreamingBodySha256 

public const string StreamingBodySha256 = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"

Field Value

string

StreamingBodySha256WithTrailer 

public const string StreamingBodySha256WithTrailer = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER"

Field Value

string

Terminator 

public const string Terminator = "aws4_request"

Field Value

string

TerminatorBytes 

public static readonly byte[] TerminatorBytes

Field Value

byte[]

UnsignedPayload 

public const string UnsignedPayload = "UNSIGNED-PAYLOAD"

Field Value

string

UnsignedPayloadWithTrailer 

public const string UnsignedPayloadWithTrailer = "STREAMING-UNSIGNED-PAYLOAD-TRAILER"

Field Value

string

V4aStreamingBodySha256 

public const string V4aStreamingBodySha256 = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD"

Field Value

string

V4aStreamingBodySha256WithTrailer 

public const string V4aStreamingBodySha256WithTrailer = "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER"

Field Value

string

Properties

Protocol 

public override ClientProtocol Protocol { get; }

Property Value

ClientProtocol

SignPayload 

public bool SignPayload { get; }

Property Value

bool

Methods

CanonicalizeHeaderNames(IEnumerable<KeyValuePair<string, string>>)

Returns the set of headers included in the signature as a flattened, ;-delimited string

protected static string CanonicalizeHeaderNames(IEnumerable<KeyValuePair<string, string>> sortedHeaders)

Parameters

sortedHeaders IEnumerable<KeyValuePair<string, string>>

The headers included in the signature

Returns

string

Formatted string of header names

CanonicalizeHeaders(IEnumerable<KeyValuePair<string, string>>)

Computes the canonical headers with values for the request. Only headers included in the signature are included in the canonicalization process.

protected static string CanonicalizeHeaders(IEnumerable<KeyValuePair<string, string>> sortedHeaders)

Parameters

sortedHeaders IEnumerable<KeyValuePair<string, string>>

All request headers, sorted into canonical order

Returns

string

Canonicalized string of headers, with the header names in lower case.

CanonicalizeQueryParameters(IEnumerable<KeyValuePair<string, string>>) 

protected static string CanonicalizeQueryParameters(IEnumerable<KeyValuePair<string, string>> parameters)

Parameters

parameters IEnumerable<KeyValuePair<string, string>>

Returns

string

CanonicalizeQueryParameters(IEnumerable<KeyValuePair<string, string>>, bool)

Computes and returns the canonicalized query string, if query parameters have been supplied. Parameters with no value will be canonicalized as 'param='. The expectation is that parameters have not already been url encoded prior to canonicalization.

protected static string CanonicalizeQueryParameters(IEnumerable<KeyValuePair<string, string>> parameters, bool uriEncodeParameters)

Parameters

parameters IEnumerable<KeyValuePair<string, string>>

The set of parameters to be encoded in the query string

uriEncodeParameters bool

Parameters must be uri encoded into the canonical request and by default the signer expects that the supplied collection contains non-encoded data. Set this to false if the encoding was done prior to signer entry.

Returns

string

The uri encoded query string parameters in canonical ordering

CanonicalizeQueryParameters(string) 

protected static string CanonicalizeQueryParameters(string queryString)

Parameters

queryString string

Returns

string

CanonicalizeQueryParameters(string, bool)

Computes and returns the canonicalized query string, if query parameters have been supplied. Parameters with no value will be canonicalized as 'param='. The expectation is that parameters have not already been url encoded prior to canonicalization.

protected static string CanonicalizeQueryParameters(string queryString, bool uriEncodeParameters)

Parameters

queryString string

The set of parameters being passed on the uri

uriEncodeParameters bool

Parameters must be uri encoded into the canonical request and by default the signer expects that the supplied collection contains non-encoded data. Set this to false if the encoding was done prior to signer entry.

Returns

string

The uri encoded query string parameters in canonical ordering

CanonicalizeRequest(Uri, string, string, IDictionary<string, string>, string, string)

Computes and returns the canonical request

protected static string CanonicalizeRequest(Uri endpoint, string resourcePath, string httpMethod, IDictionary<string, string> sortedHeaders, string canonicalQueryString, string precomputedBodyHash)

Parameters

endpoint Uri

The endpoint URL

resourcePath string

the path of the resource being operated on

httpMethod string

The http method used for the request

sortedHeaders IDictionary<string, string>

The full request headers, sorted into canonical order

canonicalQueryString string

The query parameters for the request

precomputedBodyHash string

The hash of the binary request body if present. If not supplied, the routine will look for the hash as a header on the request.

Returns

string

Canonicalised request as a string

CanonicalizeRequest(Uri, string, string, IDictionary<string, string>, string, string, IDictionary<string, string>)

Computes and returns the canonical request

protected static string CanonicalizeRequest(Uri endpoint, string resourcePath, string httpMethod, IDictionary<string, string> sortedHeaders, string canonicalQueryString, string precomputedBodyHash, IDictionary<string, string> pathResources)

Parameters

endpoint Uri

The endpoint URL

resourcePath string

the path of the resource being operated on

httpMethod string

The http method used for the request

sortedHeaders IDictionary<string, string>

The full request headers, sorted into canonical order

canonicalQueryString string

The query parameters for the request

precomputedBodyHash string
The path resource values lookup to use to replace the keys within resourcePath The hash of the binary request body if present. If not supplied, the routine will look for the hash as a header on the request.
pathResources IDictionary<string, string>

Returns

string

Canonicalised request as a string

CanonicalizeRequest(Uri, string, string, IDictionary<string, string>, string, string, IDictionary<string, string>, bool)

Computes and returns the canonical request

protected static string CanonicalizeRequest(Uri endpoint, string resourcePath, string httpMethod, IDictionary<string, string> sortedHeaders, string canonicalQueryString, string precomputedBodyHash, IDictionary<string, string> pathResources, bool doubleEncode)

Parameters

endpoint Uri

The endpoint URL

resourcePath string

the path of the resource being operated on

httpMethod string

The http method used for the request

sortedHeaders IDictionary<string, string>

The full request headers, sorted into canonical order

canonicalQueryString string

The query parameters for the request

precomputedBodyHash string
The path resource values lookup to use to replace the keys within resourcePath The hash of the binary request body if present. If not supplied, the routine will look for the hash as a header on the request.
pathResources IDictionary<string, string>
doubleEncode bool

Encode "/" when canonicalize resource path

Returns

string

Canonicalised request as a string

ComposeSigningKey(string, string, string, string)

Compute and return the multi-stage signing key for the request.

public static byte[] ComposeSigningKey(string awsSecretAccessKey, string region, string date, string service)

Parameters

awsSecretAccessKey string

The clear-text AWS secret key, if not held in secureKey

region string

The region in which the service request will be processed

date string

Date of the request, in yyyyMMdd format

service string

The name of the service being called by the request

Returns

byte[]

Computed signing key

ComputeHash(byte[])

Computes the non-keyed hash of the supplied data

public static byte[] ComputeHash(byte[] data)

Parameters

data byte[]

Returns

byte[]

ComputeHash(string)

Computes the non-keyed hash of the supplied data

public static byte[] ComputeHash(string data)

Parameters

data string

Returns

byte[]

ComputeKeyedHash(SigningAlgorithm, byte[], byte[])

Compute and return the hash of a data blob using the specified key

public static byte[] ComputeKeyedHash(SigningAlgorithm algorithm, byte[] key, byte[] data)

Parameters

algorithm SigningAlgorithm

Algorithm to use for hashing

key byte[]

Hash key

data byte[]

Data blob

Returns

byte[]

Hash of the data

ComputeKeyedHash(SigningAlgorithm, byte[], string)

Compute and return the hash of a data blob using the specified key

public static byte[] ComputeKeyedHash(SigningAlgorithm algorithm, byte[] key, string data)

Parameters

algorithm SigningAlgorithm

Algorithm to use for hashing

key byte[]

Hash key

data string

Data blob

Returns

byte[]

Hash of the data

ComputeSignature(ImmutableCredentials, string, DateTime, string, string, string)

Computes and returns an AWS4 signature for the specified canonicalized request

public static AWS4SigningResult ComputeSignature(ImmutableCredentials credentials, string region, DateTime signedAt, string service, string signedHeaders, string canonicalRequest)

Parameters

credentials ImmutableCredentials
region string
signedAt DateTime
service string
signedHeaders string
canonicalRequest string

Returns

AWS4SigningResult

ComputeSignature(string, string, string, DateTime, string, string, string)

Computes and returns an AWS4 signature for the specified canonicalized request

public static AWS4SigningResult ComputeSignature(string awsAccessKey, string awsSecretAccessKey, string region, DateTime signedAt, string service, string signedHeaders, string canonicalRequest)

Parameters

awsAccessKey string
awsSecretAccessKey string
region string
signedAt DateTime
service string
signedHeaders string
canonicalRequest string

Returns

AWS4SigningResult

ComputeSignature(string, string, string, DateTime, string, string, string, RequestMetrics)

Computes and returns an AWS4 signature for the specified canonicalized request

public static AWS4SigningResult ComputeSignature(string awsAccessKey, string awsSecretAccessKey, string region, DateTime signedAt, string service, string signedHeaders, string canonicalRequest, RequestMetrics metrics)

Parameters

awsAccessKey string
awsSecretAccessKey string
region string
signedAt DateTime
service string
signedHeaders string
canonicalRequest string
metrics RequestMetrics

Returns

AWS4SigningResult

DetermineService(IClientConfig) 

public static string DetermineService(IClientConfig clientConfig)

Parameters

clientConfig IClientConfig

Returns

string

DetermineSigningRegion(IClientConfig, string, RegionEndpoint, IRequest) 

public static string DetermineSigningRegion(IClientConfig clientConfig, string serviceName, RegionEndpoint alternateEndpoint, IRequest request)

Parameters

clientConfig IClientConfig
serviceName string
alternateEndpoint RegionEndpoint
request IRequest

Returns

string

FormatDateTime(DateTime, string)

Formats the supplied date and time for use in AWS4 signing, where various formats are used.

public static string FormatDateTime(DateTime dt, string formatString)

Parameters

dt DateTime
formatString string

The required format

Returns

string

The UTC date/time in the requested format

GetParametersToCanonicalize(IRequest)

Collects the subresource and query string parameters into one collection ready for canonicalization

protected static List<KeyValuePair<string, string>> GetParametersToCanonicalize(IRequest request)

Parameters

request IRequest

The in-flight request being signed

Returns

List<KeyValuePair<string, string>>

The fused set of parameters

InitializeHeaders(IDictionary<string, string>, Uri)

Sets the AWS4 mandated 'host' and 'x-amz-date' headers, returning the date/time that will be used throughout the signing process in various elements and formats.

public static DateTime InitializeHeaders(IDictionary<string, string> headers, Uri requestEndpoint)

Parameters

headers IDictionary<string, string>

The current set of headers

requestEndpoint Uri

Returns

DateTime

Date and time used for x-amz-date, in UTC

InitializeHeaders(IDictionary<string, string>, Uri, DateTime)

Sets the AWS4 mandated 'host' and 'x-amz-date' headers, accepting and returning the date/time that will be used throughout the signing process in various elements and formats.

public static DateTime InitializeHeaders(IDictionary<string, string> headers, Uri requestEndpoint, DateTime requestDateTime)

Parameters

headers IDictionary<string, string>

The current set of headers

requestEndpoint Uri
requestDateTime DateTime

Returns

DateTime

Date and time used for x-amz-date, in UTC

SetRequestBodyHash(IRequest, bool, string, int)

If signPayload is false set the x-amz-content-sha256 header to the UNSIGNED-PAYLOAD magic string and return it. Otherwise, if the caller has already set the x-amz-content-sha256 header with a pre-computed content hash, or it is present as ContentStreamHash on the request instance, return the value to be used in request canonicalization. If not set as a header or in the request, attempt to compute a hash based on inspection of the style of the request content.

public static string SetRequestBodyHash(IRequest request, bool signPayload, string chunkedBodyHash, int signatureLength)

Parameters

request IRequest

Request to sign

signPayload bool

Whether to sign the payload

chunkedBodyHash string

The fixed value to set for the x-amz-content-sha256 header for chunked requests

signatureLength int

Length of the signature for each chunk in a chuncked request, in bytes

Returns

string

The computed hash, whether already set in headers or computed here. Null if we were not able to compute a hash.

SetRequestBodyHash(IRequest, string, int)

If the caller has already set the x-amz-content-sha256 header with a pre-computed content hash, or it is present as ContentStreamHash on the request instance, return the value to be used in request canonicalization. If not set as a header or in the request, attempt to compute a hash based on inspection of the style of the request content.

public static string SetRequestBodyHash(IRequest request, string chunkedBodyHash, int signatureLength)

Parameters

request IRequest

Request to sign

chunkedBodyHash string

The fixed value to set for the x-amz-content-sha256 header for chunked requests

signatureLength int

Length of the signature for each chunk in a chuncked request, in bytes

Returns

string

The computed hash, whether already set in headers or computed here. Null if we were not able to compute a hash.

SetXAmzTrailerHeader(IDictionary<string, string>, IDictionary<string, string>)

Sets the x-amz-trailer header for the given set of trailing headers

public static void SetXAmzTrailerHeader(IDictionary<string, string> headers, IDictionary<string, string> trailingHeaders)

Parameters

headers IDictionary<string, string>

request's headers

trailingHeaders IDictionary<string, string>

request's trailing headers

Sign(IRequest, IClientConfig, RequestMetrics, ImmutableCredentials)

Calculates and signs the specified request using the AWS4 signing protocol by using the AWS account credentials given in the method parameters. The resulting signature is added to the request headers as 'Authorization'. Parameters supplied in the request, either in the resource path as a query string or in the Parameters collection must not have been uri encoded. If they have, use the SignRequest method to obtain a signature.

public override void Sign(IRequest request, IClientConfig clientConfig, RequestMetrics metrics, ImmutableCredentials credentials)

Parameters

request IRequest

The request to compute the signature for. Additional headers mandated by the AWS4 protocol ('host' and 'x-amz-date') will be added to the request before signing.

clientConfig IClientConfig

Client configuration data encompassing the service call (notably authentication region, endpoint and service name).

metrics RequestMetrics

Metrics for the request

credentials ImmutableCredentials

The AWS credentials for the account making the service call.

Exceptions

SignatureException

If any problems are encountered while signing the request.

Sign(IRequest, IClientConfig, RequestMetrics, string, string)

Calculates and signs the specified request using the AWS4 signing protocol by using the AWS account credentials given in the method parameters. The resulting signature is added to the request headers as 'Authorization'. Parameters supplied in the request, either in the resource path as a query string or in the Parameters collection must not have been uri encoded. If they have, use the SignRequest method to obtain a signature.

public override void Sign(IRequest request, IClientConfig clientConfig, RequestMetrics metrics, string awsAccessKeyId, string awsSecretAccessKey)

Parameters

request IRequest

The request to compute the signature for. Additional headers mandated by the AWS4 protocol ('host' and 'x-amz-date') will be added to the request before signing.

clientConfig IClientConfig

Client configuration data encompassing the service call (notably authentication region, endpoint and service name).

metrics RequestMetrics

Metrics for the request

awsAccessKeyId string

The AWS public key for the account making the service call.

awsSecretAccessKey string

The AWS secret key for the account making the call, in clear text.

Exceptions

SignatureException

If any problems are encountered while signing the request.

SignBlob(byte[], byte[])

Returns the HMAC256 for an arbitrary blob using the specified key

public static byte[] SignBlob(byte[] key, byte[] data)

Parameters

key byte[]
data byte[]

Returns

byte[]

SignBlob(byte[], string)

Returns the HMAC256 for an arbitrary blob using the specified key

public static byte[] SignBlob(byte[] key, string data)

Parameters

key byte[]
data string

Returns

byte[]

SignRequest(IRequest, IClientConfig, RequestMetrics, string, string)

Calculates and signs the specified request using the AWS4 signing protocol by using the AWS account credentials given in the method parameters.

public AWS4SigningResult SignRequest(IRequest request, IClientConfig clientConfig, RequestMetrics metrics, string awsAccessKeyId, string awsSecretAccessKey)

Parameters

request IRequest

The request to compute the signature for. Additional headers mandated by the AWS4 protocol ('host' and 'x-amz-date') will be added to the request before signing.

clientConfig IClientConfig

Client configuration data encompassing the service call (notably authentication region, endpoint and service name).

metrics RequestMetrics

Metrics for the request.

awsAccessKeyId string

The AWS public key for the account making the service call.

awsSecretAccessKey string

The AWS secret key for the account making the call, in clear text.

Returns

AWS4SigningResult

Remarks

Parameters passed as part of the resource path should be uri-encoded prior to entry to the signer. Parameters passed in the request.Parameters collection should be not be encoded; encoding will be done for these parameters as part of the construction of the canonical request.

Exceptions

SignatureException

If any problems are encountered while signing the request.

SortAndPruneHeaders(IEnumerable<KeyValuePair<string, string>>)

Reorders the headers for the request for canonicalization.

protected static IDictionary<string, string> SortAndPruneHeaders(IEnumerable<KeyValuePair<string, string>> requestHeaders)

Parameters

requestHeaders IEnumerable<KeyValuePair<string, string>>

The set of proposed headers for the request

Returns

IDictionary<string, string>

List of headers that must be included in the signature

Remarks

For AWS4 signing, all headers are considered viable for inclusion