public void testUrlSigning() throws Exception {
S3Service s3Service = getS3Service(awsCredentials);
String bucketName = awsCredentials.getAccessKey() + ".jets3t_TestCases";
S3Bucket bucket = s3Service.createBucket(bucketName);
// Create test object, with private ACL
String dataString = "Text for the URL Signing test object...";
S3Object object = new S3Object(bucket, "Testing URL Signing", dataString);
object.setContentType("text/html");
object.addMetadata("x-amz-example-header", "example-value");
object.setAcl(AccessControlList.REST_CANNED_PRIVATE);
// Determine what the time will be in 5 minutes.
Calendar cal = Calendar.getInstance();
cal.add(Calendar.MINUTE, 5);
Date expiryDate = cal.getTime();
// Create a signed HTTP PUT URL.
String signedPutUrl = S3Service.createSignedPutUrl(bucket.getName(), object.getKey(),
object.getMetadataMap(), awsCredentials, expiryDate, false);
// Put the object in S3 using the signed URL (no AWS credentials required)
RestS3Service restS3Service = new RestS3Service(null);
restS3Service.putObjectWithSignedUrl(signedPutUrl, object);
// Ensure the object was created.
S3Object objects[] = s3Service.listObjects(bucket, object.getKey(), null);
assertEquals("Signed PUT URL failed to put/create object", objects.length, 1);
// Change the object's content-type and ensure the signed PUT URL disallows the put.
object.setContentType("application/octet-stream");
try {
restS3Service.putObjectWithSignedUrl(signedPutUrl, object);
fail("Should not be able to use a signed URL for an object with a changed content-type");
} catch (S3ServiceException e) {
object.setContentType("text/html");
}
// Add an object header and ensure the signed PUT URL disallows the put.
object.addMetadata("x-amz-example-header-2", "example-value");
try {
restS3Service.putObjectWithSignedUrl(signedPutUrl, object);
fail("Should not be able to use a signed URL for an object with changed metadata");
} catch (S3ServiceException e) {
object.removeMetadata("x-amz-example-header-2");
}
// Change the object's name and ensure the signed PUT URL uses the signed name, not the object name.
String originalName = object.getKey();
object.setKey("Testing URL Signing 2");
object.setDataInputStream(new ByteArrayInputStream(dataString.getBytes()));
S3Object renamedObject = restS3Service.putObjectWithSignedUrl(signedPutUrl, object);
assertEquals("Ensure returned object key is renamed based on signed PUT URL",
originalName, renamedObject.getKey());
// Ensure we can't get the object with a normal URL.
String s3Url = "https://s3.amazonaws.com";
URL url = new URL(s3Url + "/" + bucketName + "/" + RestUtils.encodeUrlString(object.getKey()));
assertEquals("Expected denied access (403) error", 403, ((HttpURLConnection) url
.openConnection()).getResponseCode());
// Create a signed HTTP GET URL.
String signedGetUrl = S3Service.createSignedGetUrl(bucket.getName(), object.getKey(),
awsCredentials, expiryDate, false);
// Ensure the signed URL can retrieve the object.
url = new URL(signedGetUrl);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();