SignatureDoesNotMatch error when creating signed url - google-cloud-storage

Question

I'm getting SignatureDoesNotMatch error when trying to generate a signed URL for a bucket resource. I've gone over the examples in the GCP github project and looked at the code in other posts to tweak mine but something is still off about how I'm signing my data I guess.
Error Response:
<Error>
<Code>SignatureDoesNotMatch</Code>
<Message>
The request signature we calculated does not match the signature you provided. Check your Google secret key and signing method.
</Message>
<StringToSign>
GET 2944813518 /bucketName/file.mp3
</StringToSign>
</Error>
Code
public String getSignedURL(String objectName, String contentType){
long timeStamp = System.currentTimeMillis() / 1000L;
timeStamp = timeStamp + (3600 * 24 * 365 * 1000);
String dataToBeSigned = "GET\n" + contentType +"\n" + timeStamp + "\n" + "/" + settings.getStorageBucketName() + "/" + objectName;
System.out.println(dataToBeSigned);
String signature = signData(dataToBeSigned);
String urlEncodedSignature = URLEncoder.encode(signature, "UTF-8");
return new StringBuilder("https://storage.googleapis.com")
.append("/")
.append(settings.getStorageBucketName())
.append("/")
.append(objectName)
.append("?GoogleAccessId=")
.append(settings.getStorageServiceAccountId())
.append("&Expires=")
.append(timeStamp)
.append("&Signature=")
.append(urlEncodedSignature).toString();
}
private String signData(String dataToBeSigned) {
Signature signer = Signature.getInstance("SHA256withRSA");
signer.initSign(getPrivateKey());
signer.update(dataToBeSigned.getBytes("UTF-8"));
byte[] rawSignature = signer.sign();
String base64EncodedSignature = new String(Base64.encodeBase64(rawSignature,false),"UTF-8");
return base64EncodedSignature;
}
private PrivateKey getPrivateKey() {
InputStream inputStream = new FileInputStream(settings.getStorageAccessKeyLocation());
String password = settings.getStorageAccessKeyPassword();
return SecurityUtils.loadPrivateKeyFromKeyStore(SecurityUtils.getPkcs12KeyStore(), inputStream, password, "privatekey", password);
}

Answer 1

If you use Spring, the easiest way to sign GCP URL is via GCP SDK https://cloud.google.com/storage/docs/reference/libraries#client-libraries-usage-java
spring-cloud-gcp-starter-storage
To set up integration with GCP define properties in the application.yml:
spring:
cloud:
gcp:
project-id: PROJECT_ID
credentials:
location: classpath:GCP_SERVICE_ACCOUNT_KEY.json
#Autowired
private Storage storage;
public String getSignedUrlToWinReleasesBucketViaSdk() {
GoogleStorageResource googleStorageResource = new GoogleStorageResource(storage, "gs://BUCKET_NAME");
URL signedUrl = googleStorageResource.getBucket().get("OBJECT_NAME")
.signUrl(15, TimeUnit.MINUTES);
return signedUrl.toString();
}
Solution without GCP SDK:
public String getSignedUrlToWinReleasesBucket(String bucketName, String objectName) {
String expirationTime = nowPlusMinutes(15);
String urlTemplate = "GET" + "\n"
+ "" + "\n"
+ "" + "\n"
+ expirationTime + "\n"
+ "/" + bucketName + "/" + objectName;
String signature = getSignedString(urlTemplate, privateKey());
// URL encode the signed string so that we can add this URL
signature = URLEncoder.encode(signature, StandardCharsets.UTF_8);
String signedUrl = baseStorageUrl + "/" + bucketName + "/" + objectName
+ "?GoogleAccessId=" + gcpStorageClientEmail
+ "&Expires=" + expirationTime
+ "&Signature=" + signature;
return signedUrl;
}
private static String nowPlusMinutes(int minutes) {
long now = System.currentTimeMillis();
long expiredTimeInSeconds = (now + 60 * 1000L * minutes) / 1000;
return String.valueOf(expiredTimeInSeconds);
}
private static String getSignedString(String input, PrivateKey privateKey) {
try {
Signature privateSignature = Signature.getInstance("SHA256withRSA");
privateSignature.initSign(privateKey);
privateSignature.update(input.getBytes(StandardCharsets.UTF_8));
byte[] s = privateSignature.sign();
return Base64.encodeBase64String(s);
} catch (GeneralSecurityException e) {
throw new Exception("Cannot sign url with GCP Storage private key.", e, HttpStatus.INTERNAL_SERVER_ERROR);
}
}
private PrivateKey privateKey() {
String key = gcpStoragePrivateKey
.replaceAll("-----END PRIVATE KEY-----", "")
.replaceAll("-----BEGIN PRIVATE KEY-----", "")
.replaceAll("\n", "");
byte[] keyDecoded = Base64.decodeBase64(key);
PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyDecoded);
try {
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
return keyFactory.generatePrivate(spec);
} catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
throw new Exception("Cannot get GCP Storage private key.", e, HttpStatus.INTERNAL_SERVER_ERROR);
}
}