AWS signature version 4 parsing issue

Question

I am working on aws signature version 4. Now my concern is that I receive signature from api request at Amazon api gateway and gateway auhorize and authenticate the request and forward to php microservice. Now I want to detect user from signature that is in request headers. How I can resolve this issue.

Below is my working code through I generate aws signature

public function generateAWSToken($uid) {
        try {
            $method = 'GET';
            $uri = '/dev';
            $json = file_get_contents('php://input');
            $obj = json_decode($json);


            if (isset($obj->method)) {
                $m = explode("|", $obj->method);
                $method = $m[0];
                $uri .= $m[1];
            }


            $secretKey = env('AWS_SECRET_ACCESS_KEY');
            $access_key = env('AKIAJR2JSY655JXI5LIA');
            $token = env('AWS_SECRET_ACCESS_KEY');
            $region = env('AWS_DEFAULT_REGIO');
            $service = 'execute-api';

            $options = array();
            $headers = array();
            $host = "YOUR-API-HOST.execute-api.ap-southeast-1.amazonaws.com";
//Or you can define your host here.. I am using API gateway.

            $alg = 'sha256';

            $date = new \DateTime('UTC');

            $dd = $date->format('Ymd\THis\Z');

            $amzdate2 = new \DateTime('UTC');
            $amzdate2 = $amzdate2->format('Ymd');
            $amzdate = $dd;

            $algorithm = 'AWS4-HMAC-SHA256';

//            $parameters = (array) $obj->data;

            if (isset($obj->data) && ($obj->data == null || empty($obj->data))) {
                $obj->data = "";
            } else {
                $param = "";
//                $param = json_encode($obj->data);
//                if ($param == "{}") {
//                    $param = "";
//                }

                $requestPayload = strtolower($param);
                $hashedPayload = hash($alg, $uid);

                $canonical_uri = $uri;
                $canonical_querystring = '';

                $canonical_headers = "content-type:" . "application/json" . "\n" . "host:" . $host . "\n" . "x-amz-date:" . $amzdate . "\n" . "x-amz-security-token:" . $token . "\n";
                $signed_headers = 'content-type;host;x-amz-date;x-amz-security-token';
                $canonical_request = "" . $method . "\n" . $canonical_uri . "\n" . $canonical_querystring . "\n" . $canonical_headers . "\n" . $signed_headers . "\n" . $hashedPayload;


                $credential_scope = $amzdate2 . '/' . $region . '/' . $service . '/' . 'aws4_request';
                $string_to_sign = "" . $algorithm . "\n" . $amzdate . "\n" . $credential_scope . "\n" . hash('sha256', $canonical_request) . "";
                //string_to_sign is the answer..hash('sha256', $canonical_request)//

                $kSecret = 'AWS4' . $secretKey;
                $kDate = hash_hmac($alg, $amzdate2, $kSecret, true);
                $kRegion = hash_hmac($alg, $region, $kDate, true);
                $kService = hash_hmac($alg, $service, $kRegion, true);
                $kSigning = hash_hmac($alg, 'aws4_request', $kService, true);
                $signature = hash_hmac($alg, $string_to_sign, $kSigning);
                $authorization_header = $algorithm . ' ' . 'Credential=' . $access_key . '/' . $credential_scope . ', ' . 'SignedHeaders=' . $signed_headers . ', ' . 'Signature=' . $signature;

                $headers = [
                    'content-type' => 'application/json',
                    'x-amz-security-token' => $token,
                    'x-amz-date' => $amzdate,
                    'Authorization' => $authorization_header];
                return $signature;
            }
        } catch (\Exception $ex) {
            return false;
        }
    }

Suggest any usefull link and method.

score 0 · Answer 1 · answered Jul 16 '18 at 17:05

How are you generating the AKS+AKI+token? If you are using Cognito pools & identity federation, this should be helpful. This helped me

how to user identity id to link to cognito user pool

PS: this might be a copy-paste error but surely the token is not $token = env('AWS_SECRET_ACCESS_KEY');

AWS signature version 4 parsing issue

1 Answers1