Presigned URL SignatureDoesNotMatch on Digital Oceans Spaces

August 7, 2019 196 views
DigitalOcean Node.js

Hi all. I’m new to spaces and I can’t seem to get a valid Pre-signed URL with this code. If anyone has pointers or corrections I would really appreciate it.
I have also added a wildcard CORS with all permissions.

module.exports = async function (context, req) {
    const aws = require('aws-sdk');

    var signedURL;

    let DO_ENDPOINT = req.body.do_endpoint;
    let DO_ACCESS_KEY_ID = req.body.access_key;
    let DO_SECRET_ACCESS_KEY = req.body.secret_key;
    let DO_SPACE = req.body.bucket;
    let DO_GUID = req.body.key;

    const spacesEndpoint = new aws.Endpoint(DO_ENDPOINT);
    const s3 = new aws.S3({
        endpoint: spacesEndpoint,
        accessKeyId: DO_ACCESS_KEY_ID,
        secretAccessKey: DO_SECRET_ACCESS_KEY,
    });

    const s3Params = {
        Bucket: DO_SPACE,
        Key: DO_GUID,
        ACL: 'public-read',
        Expires: 600,
    };

    s3.getSignedUrl('putObject', s3Params, function (err, url) {
        if (err) {
            context.res = {
                status: 400,
                body: "Something went wrong, please try again."
            };
        } else {
            context.res = {
                body: url
            };
        }
    });
};

The error I keep getting is:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>SignatureDoesNotMatch</Code>
    <RequestId>tx0000000000000a3a794c8-005d4ad207-11f28ea-ams3a</RequestId>
    <HostId>11f28ea-ams3a-ams3</HostId>
</Error>
2 Answers
SkippyBit August 8, 2019
Accepted Answer

Hi @robbat2, the pre-signed URL is going to be used for directly uploading file content of images.

Was trying to make a URL that did not need the content-type, but found out yesterday that the content-type was all that was missing in the PUT request.

So this azure function code works:

module.exports = async function (context, req) {
    const aws = require('aws-sdk');

    var signedURL;

    let DO_ENDPOINT = req.body.do_endpoint;
    let DO_ACCESS_KEY_ID = req.body.access_key;
    let DO_SECRET_ACCESS_KEY = req.body.secret_key;
    let DO_SPACE = req.body.bucket;
    let DO_GUID = req.body.key;

    const spacesEndpoint = new aws.Endpoint(DO_ENDPOINT);
    const s3 = new aws.S3({
        endpoint: spacesEndpoint,
        accessKeyId: DO_ACCESS_KEY_ID,
        secretAccessKey: DO_SECRET_ACCESS_KEY,
    });

    const s3Params = {
        Bucket: DO_SPACE,
        Key: DO_GUID,
        ContentType: 'image/jpeg',
        ACL: 'public-read',
        Expires: 600,
    };

    s3.getSignedUrl('putObject', s3Params, function (err, url) {
        if (err) {
            context.res = {
                status: 400,
                body: "Something went wrong, please try again."
            };
        } else {
            context.res = {
                body: url
            };
        }
    });
};

Only thing that needs to be added is the headers in the PUT request:

x-amz-acl:public-read
Content-Type:image/jpeg

Current code is for .jpeg file and needs to be passed the MIME type if its going to be used for something else.

Hi, Spaces engineering team member here.

Need a lot more detail about how you’re using the returned URL for your presigned request.

At the very least, you need to confirm that you’re using the HTTP PUT verb in the request with the presigned URL (not POST, not GET)

The team can help you debug it best if you can post (or send a support ticket) with the full HTTP transaction, showing the full HTTP headers on both the request & response side (you should redact your values of DO_ACCESS_KEY_ID and DO_SPACE if you do post it publically)

Have another answer? Share your knowledge.