node.js - Azure：按照文档完成后，使用 Azure REST API 的表 acl GET 不起作用

Question

我正在关注GET ACL Table和Authentication for the Azure Storage Services的 Azure REST 文档。

下面是我正在执行的 REST 操作的代码片段。

//Input your Storage Account and access-key associated to it.
const yourStorageAccountName = '';
const accessKeyStorageAccount = '';
const Client = require('node-rest-client').Client;
const crypto = require("crypto");

async function getTableAcl() {
    let now = new Date();
    let nowUTC = now.toUTCString();
    let contentType = "application/json"
    // construct input value
    let stringToSign = `GET\n\n\n${nowUTC}\n/${yourStorageAccountName}/tablename\ncomp:acl`;
    let accesskey = accessKeyStorageAccount;
    // create base64 encoded signature
    let key = new Buffer(accesskey, "base64");
    let hmac = crypto.createHmac("sha256", key);
    hmac.update(stringToSign);
    let sig = hmac.digest("base64");
    console.log("SIGNATURE : " + sig);
    console.log("nowutc : " + nowUTC);
    let args = {
        headers: {
            "Authorization": "SharedKey " + yourStorageAccountName + ":" + sig,
            "Date": nowUTC,
            "x-ms-version": "2015-12-11"
        }
    };
    let restClient = new Client();
    restClient.get(`https://${yourStorageAccountName}.table.core.windows.net/tablename?comp=acl`, args, function (data, response) {
        console.log(JSON.stringify(data));
        //console.log(response);
    });
}

getTableAcl()

这里要注意的是，Azure 表 ACL 文档中没有提到 Content-Type，但在 Authorization 标头部分中给出了包含 Content-Type。因此，我在“stringToSign”中将内容类型保持为空，并且没有在 REST 调用中提供 Content-Type 标头。我可能遗漏了一些东西，但我无法确定它可能是什么。

如果我在这种情况下遗漏了什么，你能告诉我吗？

标签： node.jsazureazure-storage

Answer 1

Basically the issue is that you're generating canonicalized resource string correctly.

The documentation states the following:

2009-09-19 and later Shared Key Lite and Table service format

This format supports Shared Key and Shared Key Lite for all versions of the Table service, and Shared Key Lite for version 2009-09-19 and later of the Blob and Queue services and version 2014-02-14 and later of the File service. This format is identical to that used with previous versions of the storage services. Construct the CanonicalizedResource string in this format as follows:

1. Beginning with an empty string (""), append a forward slash (/), followed by the name of the account that owns the resource being accessed.
2. Append the resource's encoded URI path. If the request URI addresses a component of the resource, append the appropriate query string. The query string should include the question mark and the comp parameter (for example, ?comp=metadata). No other parameters should be included on the query string.

Based on this, your stringToSign should be:

let stringToSign = `GET\n\n\n${nowUTC}\n/${yourStorageAccountName}/tablename?comp=acl`;

Give it a try, it should work.