APISIX HMAC 认证

global_auth: false
consumers:
- name: consumer1
  access_key: consumer1-key
  secret_key: 2bda943c-ba2b-11ec-ba07-00163e1250b5
- name: consumer2
  access_key: consumer2-key
  secret_key: c8c8e9ca-558e-4a2d-bb62-e700dcc40e35

allow:
- consumer1  # 仅允许consumer1访问

allow:
- consumer2  # 仅允许consumer2访问

package main

import (
  "crypto/hmac"
  "crypto/sha1"
  "crypto/sha256"
  "crypto/sha512"
  "encoding/base64"
  "fmt"
  "hash"
  "strings"
  "time"
)

// SignedHeader 定义签名头的结构
type SignedHeader struct {
  Name  string
  Value string
}

func main() {
  // 配置参数
  keyID := "consumer1-key"                            // key id
  secretKey := "2bda943c-ba2b-11ec-ba07-00163e1250b5" // secret key
  requestMethod := "POST"                             // HTTP method
  requestPath := "/foo"                               // Route URI
  algorithm := "hmac-sha256"                          // algorithm
  validateRequestBody := false                        // 是否验证请求体，设置为true时会添加Digest头部

  // 如果配置了 signed_headers，则需要按照顺序添加
  signedHeaders := []SignedHeader{
    //{Name: "x-custom-header-a", Value: "test1"},
    //{Name: "x-custom-header-b", Value: "test2"},
  }

  body := []byte("{}") // request body

  // 获取当前 GMT 时间
  gmtTime := time.Now().UTC().Format("Mon, 02 Jan 2006 15:04:05 GMT")

  // 动态构造签名字符串（有序）
  signingStringBuilder := strings.Builder{}
  signingStringBuilder.WriteString(fmt.Sprintf("%s\n%s %s\ndate: %s\n",
    keyID,
    requestMethod,
    requestPath,
    gmtTime))

  // 按照signedHeaders中的顺序添加header
  for _, header := range signedHeaders {
    signingStringBuilder.WriteString(fmt.Sprintf("%s: %s\n", header.Name, header.Value))
  }

  signingString := signingStringBuilder.String()

  // 创建签名
  signature, err := generateHmacSignature(secretKey, algorithm, signingString)
  if err != nil {
    fmt.Printf("Error generating signature: %v\n", err)
    return
  }

  // 动态构建headers字段内容
  headersField := "@request-target date"
  for _, header := range signedHeaders {
    headersField += " " + header.Name
  }

  // 构造请求头部
  headers := map[string]string{
    "Date": gmtTime,
    "Authorization": fmt.Sprintf(`Signature keyId="%s",algorithm="%s",headers="%s",signature="%s"`,
      keyID,
      algorithm,
      headersField,
      signature,
    ),
  }

  // 如果需要验证请求体，则添加Digest头部
  if validateRequestBody {
    headers["Digest"] = calculateBodyDigest(body)
  }

  // 添加签名的请求头
  for _, header := range signedHeaders {
    formattedHeaderName := formatHeaderName(header.Name)
    headers[formattedHeaderName] = header.Value
  }

  // 打印签名字符串
  fmt.Printf("signingString: %s\n", signingString)
  // 打印请求头
  fmt.Println("Headers:")
  for key, value := range headers {
    fmt.Printf("%s: %s\n", key, value)
  }
}

// generateHmacSignature 生成HMAC签名
func generateHmacSignature(secretKey, algorithm, message string) (string, error) {
  var mac hash.Hash

  switch algorithm {
  case "hmac-sha1":
    mac = hmac.New(sha1.New, []byte(secretKey))
  case "hmac-sha256":
    mac = hmac.New(sha256.New, []byte(secretKey))
  case "hmac-sha512":
    mac = hmac.New(sha512.New, []byte(secretKey))
  default:
    return "", fmt.Errorf("unsupported algorithm: %s", algorithm)
  }

  mac.Write([]byte(message))
  signature := mac.Sum(nil)
  return base64.StdEncoding.EncodeToString(signature), nil
}

// calculateBodyDigest 计算body的摘要
func calculateBodyDigest(body []byte) string {
  hash := sha256.Sum256(body)
  encodedDigest := base64.StdEncoding.EncodeToString(hash[:])
  return "SHA-256=" + encodedDigest
}

// formatHeaderName 将header name转换为标准HTTP头格式
func formatHeaderName(headerName string) string {
  parts := strings.Split(headerName, "-")
  for i, part := range parts {
    if len(part) > 0 {
      parts[i] = strings.ToUpper(part[:1]) + strings.ToLower(part[1:])
    }
  }
  return strings.Join(parts, "-")
}

global_auth: false
consumers:
- name: consumer1
  access_key: consumer1-key
  secret_key: 2bda943c-ba2b-11ec-ba07-00163e1250b5
- name: consumer2
  access_key: consumer2-key
  secret_key: c8c8e9ca-558e-4a2d-bb62-e700dcc40e35
signed_headers:  # 需要纳入签名的自定义请求头
- X-Custom-Header-A
- X-Custom-Header-B
validate_request_body: true  # 启用请求体签名校验

global_auth: true  # 开启全局认证
consumers:
- name: consumer1
  access_key: consumer1-key
  secret_key: 2bda943c-ba2b-11ec-ba07-00163e1250b5
- name: consumer2
  access_key: consumer2-key
  secret_key: c8c8e9ca-558e-4a2d-bb62-e700dcc40e35