1StringToSign = <Timestamp> + "\n" + <RawBody>

1Signature = HexEncode(
2    HMAC-SHA256(
3        SecretKey,
4        Timestamp + "\n" + Body
5    )
6)

1package auth
2
3import (
4    "crypto/hmac"
5    "crypto/sha256"
6    "encoding/hex"
7    "fmt"
8)
9
10// GenerateSignature 生成 HMAC-SHA256 签名
11func GenerateSignature(secret, timestamp, body string) string {
12    stringToSign := fmt.Sprintf("%s\n%s", timestamp, body)
13
14    h := hmac.New(sha256.New, []byte(secret))
15    h.Write([]byte(stringToSign))
16
17    return hex.EncodeToString(h.Sum(nil))
18}

1package main
2
3import (
4    "bytes"
5    "crypto/subtle"
6    "io"
7    "net/http"
8    "strconv"
9    "time"
10)
11
12const (
13    SecretKey       = "your-configured-secret-key"
14    MaxTimeDiff     = 300 // 5分钟
15    HeaderSignature = "X-Bce-Signature"
16    HeaderTimestamp = "X-Bce-Timestamp"
17)
18
19func VerifyHandler(w http.ResponseWriter, r *http.Request) {
20    receivedSign := r.Header.Get(HeaderSignature)
21    receivedTimestamp := r.Header.Get(HeaderTimestamp)
22
23    if receivedSign == "" || receivedTimestamp == "" {
24        http.Error(w, "Missing Auth Headers", http.StatusUnauthorized)
25        return
26    }
27
28    // 时间戳校验
29    ts, err := strconv.ParseInt(receivedTimestamp, 10, 64)
30    if err != nil {
31        http.Error(w, "Invalid Timestamp", http.StatusBadRequest)
32        return
33    }
34
35    now := time.Now().Unix()
36    if now-ts > MaxTimeDiff || ts-now > MaxTimeDiff {
37        http.Error(w, "Request Timed Out", http.StatusRequestTimeout)
38        return
39    }
40
41    // 读取 Body
42    bodyBytes, _ := io.ReadAll(r.Body)
43    r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
44    bodyStr := string(bodyBytes)
45
46    // 回算签名
47    expectedSign := GenerateSignature(SecretKey, receivedTimestamp, bodyStr)
48
49    // 安全比较（防时序攻击）
50    if subtle.ConstantTimeCompare([]byte(expectedSign), []byte(receivedSign)) != 1 {
51        http.Error(w, "Invalid Signature", http.StatusUnauthorized)
52        return
53    }
54
55    w.WriteHeader(http.StatusOK)
56}