验证签名

验证签名的过程即为签名的逆过程，由应用服务器验证，过程如下：

Result = rsa_verify(public_key, md5(url_decode(path) + query_string + ‘n’ + body), base64_decode(authorization))

字段的含义与签名过程中描述相同，其中public_key为公钥， authorization为回调头中的签名，整个验证签名的过程分为以下几步：

• 回调请求的x-oss-pub-key-url头保存的是公钥的url地址的base64编码，因此需要对其做base64解码后获取到公钥，即

public_key = urlopen(base64_decode(x-oss-pub-key-url头的值))

这里需要注意，用户需要校验x-oss-pub-key-url头的值必须以https://gosspublic.alicdn.com/或者https://gosspublic.alicdn.com/开头，目的是为了保证这个publickey是由OSS颁发的。

• 获取base64解码后的签名

signature = base64_decode(authorization头的值)

• 获取待签名字符串，方法与签名一致

sign_str = url_decode(path) + query_string + ‘n’ + body

• 验证签名

result = rsa_verify(public_key, md5(sign_str), signature)

以上例为例：

• 获取到公钥的url地址，即aHR0cDovL2dvc3NwdWJsaWMuYWxpY2RuLmNvbS9jYWxsYmFja19wdWJfa2V5X3YxLnBlbQ==经过base64解码后得到https://gosspublic.alicdn.com/callback_pub_key_v1.pem
• 签名头kKQeGTRccDKyHB3H9vF+xYMSrmhMZjzzl2/kdD1ktNVgbWEfYTQG0G2SU/RaHBovRCE8OkQDjC3uG33esH2txA==做base64解码（由于为非打印字符，无法显示出解码后的结果）
• 获取待签名字符串，即url_decode(“index.php”) + “?id=1&index=2” + “n” + “bucket=yonghu-test”，并做md5
• 验证签名

应用服务器示例

以下为一段python示例，演示了一个简单的应用服务器，主要是说明验证签名的方法，此示例需要安装M2Crypto库

import httplib
import base64
import md5
import urllib2
from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
from M2Crypto import RSA
from M2Crypto import BIO
def get_local_ip():
    try:
        csock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        csock.connect(('8.8.8.8', 80))
        (addr, port) = csock.getsockname()
        csock.close()
        return addr
    except socket.error:
        return ""
class MyHTTPRequestHandler(BaseHTTPRequestHandler):
    '''
    def log_message(self, format, *args):
        return
    '''
    def do_POST(self):
        #get public key
        pub_key_url = ''
        try:
            pub_key_url_base64 = self.headers['x-oss-pub-key-url']
            pub_key_url = pub_key_url_base64.decode('base64')
            if not pub_key_url.startswith("https://gosspublic.alicdn.com/") and not pub_key_url.startswith("https://gosspublic.alicdn.com/"):
                self.send_response(400)
                self.end_headers()
                return
            url_reader = urllib2.urlopen(pub_key_url)
            #you can cache it
            pub_key = url_reader.read() 
        except:
            print 'pub_key_url : ' + pub_key_url
            print 'Get pub key failed!'
            self.send_response(400)
            self.end_headers()
            return
        #get authorization
        authorization_base64 = self.headers['authorization']
        authorization = authorization_base64.decode('base64')
        #get callback body
        content_length = self.headers['content-length']
        callback_body = self.rfile.read(int(content_length))
        #compose authorization string
        auth_str = ''
        pos = self.path.find('?')
        if -1 == pos:
            auth_str = urllib2.unquote(self.path) + 'n' + callback_body
        else:
            auth_str = urllib2.unquote(self.path[0:pos]) + self.path[pos:] + 'n' + callback_body
        print auth_str
        #verify authorization
        auth_md5 = md5.new(auth_str).digest()
        bio = BIO.MemoryBuffer(pub_key)
        rsa_pub = RSA.load_pub_key_bio(bio)
        try:
            result = rsa_pub.verify(auth_md5, authorization, 'md5')
        except:
            result = False
        if not result:
            print 'Authorization verify failed!'
            print 'Public key : %s' % (pub_key)
            print 'Auth string : %s' % (auth_str)
            self.send_response(400)
            self.end_headers()
            return
        #do something accoding to callback_body
        #response to OSS
        resp_body = '{"Status":"OK"}'
        self.send_response(200)
        self.send_header('Content-Type', 'application/json')
        self.send_header('Content-Length', str(len(resp_body)))
        self.end_headers()
        self.wfile.write(resp_body)
class MyHTTPServer(HTTPServer):
    def __init__(self, host, port):
        HTTPServer.__init__(self, (host, port), MyHTTPRequestHandler)
if '__main__' == __name__:
    server_ip = get_local_ip()
server_port = 23451
server = MyHTTPServer(server_ip, server_port)
server.serve_forever()

其它语言实现的应用服务器如下：