Cloud Storage: Signed URL determine generation from BlobInfo about java-storage HOT 6 CLOSED

If it is a backend change that needs to happen, a feature request should be opened on the backend service issue tracker.

from java-storage.

backend issue: https://issuetracker.google.com/issues/146802530

from java-storage.

Hi @dmitry-fa,

Thanks for filing this issue.

Right now a user of the signUrl() method is required to provide Query Parameters here's the working example. V4 signed URLs require that all Query Parameters be signed compared to V2 signed URLs which doesn't require all Query Parameters to be signed. This allows the flexibility you are experiencing.

package com.example.storage;

import com.google.auth.oauth2.GoogleCredentials;
import com.google.cloud.storage.Blob;
import com.google.cloud.storage.BlobId;
import com.google.cloud.storage.Storage;
import com.google.cloud.storage.StorageOptions;
import com.google.common.collect.ImmutableMap;

import java.io.ByteArrayInputStream;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.Arrays;
import java.util.List;
import java.util.concurrent.TimeUnit;

public class ExampleOther {
    public static void main(String... args) throws Exception {
        Storage storage = StorageOptions.getDefaultInstance().getService();

        String bucketName = "anima-frank";
        String blobName = "test";
        long generation = 1579134868998095L;

        BlobId blobId = BlobId.of(bucketName, blobName, generation);
        Blob blob = storage.get(blobId, Storage.BlobGetOption.generationMatch());
        System.out.println("blob: " + blob);
        System.out.println("v2 " + blob.signUrl(20, TimeUnit.MINUTES, Storage.SignUrlOption.withV2Signature()));
        System.out.println("v4 " + blob.signUrl(20, TimeUnit.MINUTES, Storage.SignUrlOption.withV4Signature(),
                Storage.SignUrlOption.withQueryParams(ImmutableMap.of("generation", "1579134868998095"))));
    }
}

At the moment signUrl doesn't get information from the generation value set in the Blob, but is a good feature request to follow-up on.

HTH for now.

from java-storage.

Hi @frankyn,

Thanks for your response. The example works for me.

At the moment signUrl doesn't get information from the generation value set in the Blob, but is a good feature request to follow-up on.

Do you believe it is a backend duty to take care of generations (issue#146802530) or this should be implemented on the client side?

from java-storage.

No this is primarily client side only. I closed the bug with some context.

For right now, this is WAI. V2 doesn't require all query parameters to be signed, therefore a user can add additional query parameters without failing the signature check.

I'd leave this open as a feature request rather than a bug because we have an intended path for folks to use.

from java-storage.

It seems that Storage.signUrl(BlobInfo) can distinguish cases when generation is explicitly specified, from cases when generation is not needed:

storage.signUrl(BlobInfo.newBuilder(bucketName, blobName, generation).build(), ...)
storage.signUrl(BlobInfo.newBuilder(bucketName, blobName).build(), ...)

But this is not always easy:

BlobInfo blobInfo = BlobInfo.newBuilder(bucketName, blobName).build(); 
      // blobInfo.getGeneration() !== null
Blob blob = storage.createBlob(blobInfo);
     // blob.getGeneration() !== null
storage.signUrl(blob);  

Including generation in signed URL by default is not a good idea. People will be confused if their URL starts point to an outdated resource. I hope, giving examples on how to sign URL for a blob generation should be enough.

from java-storage.