Spring GCP Storage预签名URL签名不匹配问题求助

问题背景 #

我使用Spring GCP Storage上传文件并生成公共预签名链接，但通过Postman、curl或Webflux WebClient访问该链接时，始终返回SignatureDoesNotMatch错误。

上传并生成预签名链接的代码 #

Storage.BlobWriteOption precondition;
Blob blob = storage.get(bucketName, name);
if (blob == null) {
  precondition = Storage.BlobWriteOption.doesNotExist();
} else {
  precondition = Storage.BlobWriteOption.generationMatch(blob.getGeneration());
}

Blob rs = storage.createFrom(BlobInfo.newBuilder(BlobId.of(bucket.getName(), name)).setContentType("application/octet-stream").build(), inputStream, precondition);

BlobId blobId = rs.getBlobId();
URL url =
    storage.signUrl(
        BlobInfo.newBuilder(blobId).build(),
        Duration.ofHours(1).toMillis() - 10000,
        TimeUnit.MILLISECONDS,
        Storage.SignUrlOption.httpMethod(HttpMethod.GET),
        Storage.SignUrlOption.withExtHeaders(Map.of("Content-Type", "application/octet-stream")));

生成的预签名链接示例 #

https://storage.googleapis.com/vocab-be-local/vocab.zip?GoogleAccessId=my-account@vocab-local.iam.gserviceaccount.com&Expires=1715751607&Signature=Vz2G8qr%2Fy%2BN8vR7yiPIQlnpzyaz2s5qGLcTL4nE7w3B6gXprtODGzz8Dk49v%2BMbrCg6IcHi1ZGN9ZNYVZyM7VW3RUZ6QOOIPbA62AEzM1T9UUYIaxGYkE7xGCFC3a6LBv%2FCnN6F28eau3wdGpldwC5iwccrwSYIpozK43Whklk%2B%2BHekjq%2BgnI%2F%2FnuqBWa1Z9P8RBejlz9ajnaxriaFOUyvlBLQBShnxM4q%2BdAJWeFlocMZIk7ZSiGuh1gTi2HTecxzod9bIRu%2FmhecpMlmPP2PvQSW0dqxMuonfxxxj3Eby7hRXOy6wNKSWU4DqZkUJm29AHOyO1vqgc2KaQevbWdw%3D%3D

错误响应信息 #

<?xml version='1.0' encoding='UTF-8'?>
<Error>
    <Code>SignatureDoesNotMatch</Code>
    <Message>Access denied.</Message>
    <Details>The request signature we calculated does not match the signature you provided. Check your Google secret key and signing method.</Details>
    <StringToSign>GET

application/octet-stream
1715751607
/vocab-be-local/vocab.zip</StringToSign>
</Error>

Webflux WebClient测试代码 #

WebClient.create()
    .get().uri(d.getImageUrl())
    .header("Content-Type", "application/octet-stream")
    .retrieve()
    .toEntity(byte[].class)
    .block()

环境与配置信息 #

版本信息 #

Spring boot 3.2.0
Spring cloud 2023.0.1
Spring cloud GCP 5.1.2

pom.xml依赖 #

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-webflux</artifactId>
</dependency>
<dependency>
    <groupId>com.google.cloud</groupId>
    <artifactId>spring-cloud-gcp-starter-storage</artifactId>
</dependency>

application.yml配置 #

spring:
  cloud:
    gcp:
      credentials:
        location: classpath:google/sa/vocab-storage-local.json
      storage:
        project-id: my-project

服务账号JSON信息 #

{
  "type": "service_account",
  "project_id": "my-project",
  "private_key_id": "***********",
  "private_key": "-----BEGIN PRIVATE KEY-----\n********\n-----END PRIVATE KEY-----\n",
  "client_email": "******@******.iam.gserviceaccount.com",
  "client_id": "*******************",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/********",
  "universe_domain": "googleapis.com"
}

已尝试的操作 #

我查阅了大量相关问题，尝试在上传和签名时添加Content-Type，但问题仍未解决，恳请帮助！

内容的提问来源于stack exchange，提问作者SoT