function get_signed_url($url, $private_key, $key_pair_id, $expires, $client_ip = null)
{
$policy = '{' . '"Statement":[' . '{' . '"Resource":"' . $url . '",' . '"Condition":{';
if (!is_null($client_ip)) {
$policy .= '"IpAddress":{"AWS:SourceIp":"' . $client_ip . '/32"},';
}
$policy .= '"DateLessThan":{"AWS:EpochTime":' . $expires . '}' . '}' . '}' . ']' . '}';
// the policy contains characters that cannot be part of a URL, so we base64 encode it
$encoded_policy = url_safe_base64_encode($policy);
// sign the original policy, not the encoded version
$signature = '';
$pkeyid = openssl_get_privatekey($private_key);
// compute signature
openssl_sign($policy, $signature, $pkeyid);
// free the key from memory
openssl_free_key($pkeyid);
// make the signature is safe to be included in a url
$encoded_signature = url_safe_base64_encode($signature);
// combine the above into a signed url
// if the signed url already contains query parameters, attach the new query parameters to the end
// otherwise, add the query parameters
$separator = strpos($url, '?') == FALSE ? '?' : '&';
// no IP restriction means we are using a canned policy
if (!is_null($client_ip)) {
$url .= $separator . "Expires=" . $expires . "&Signature=" . $encoded_signature . "&Key-Pair-Id=" . $key_pair_id;
} else {
$url .= $separator . "Policy=" . $encoded_policy . "&Signature=" . $encoded_signature . "&Key-Pair-Id=" . $key_pair_id;
}
// new lines would break us, so remove them
return str_replace('\\n', '', $url);
}
<?php
function url_safe_base64_encode($value)
{
$encoded = base64_encode($value);
// replace unsafe characters +, = and / with
// the safe characters -, _ and ~
return str_replace(array('+', '=', '/'), array('-', '_', '~'), $encoded);
}
function rsa_sha1_sign($policy)
{
$priv_key = file_get_contents("/Users/joelsaltzman/Desktop/privatekey");
$pkeyid = openssl_get_privatekey($priv_key);
openssl_sign($policy, $signature, $pkeyid);
openssl_free_key($pkeyid);
return $signature;
}
$signature = rsa_sha1_sign("testing");
$encodedSignature = url_safe_base64_encode($signature);
echo $encodedSignature;
//correct results
function create_signed_url($asset_path, $private_key_filename, $key_pair_id, $expires)
{
// Build the policy.
$canned_policy = '{"Statement":[{"Resource":"' . $asset_path . '","Condition":{"DateLessThan":{"AWS:EpochTime":' . $expires . '}}}]}';
/*$canned_policy = '
{
"Id": "Policy1440586376040",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1440586363543",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::direct2consumer/*",
"Principal": {
"CanonicalUser": [
"8a09356196995b1dc7ea047cf369b33d7ecdeb9c0e65fbdebcd3f52d17c2979c6fc14c8e7f7afa5f39d8ed644c677480"
]
}
}
]
}'; */
// Sign the policy.
$signature = rsa_sha1_sign($canned_policy, $private_key_filename);
// Make the signature contains only characters that
// can be included in a URL.
$encoded_signature = url_safe_base64_encode($signature);
// Combine the above into a properly formed URL name
return $asset_path . '?Expires=' . $expires . '&Signature=' . $encoded_signature . '&Key-Pair-Id=' . $key_pair_id;
}
function cloudFrontCannedPolicyURLSign($mediaFilePath)
{
// this policy is well known by CloudFront, but you still need to sign it,
// since it contains your parameters
//Location of the CLoudFront key on the server:
$private_key_filename = '/var/AWSKeys/CloudFront/pk-APKAI3O4WVSJRO2O3K4Q.pem';
//The CloudFront key pair ID. NOTE CLOUDFRONT IS SEPERATE TO STANDARD IAM STUFF, WHY? WHO KNOWS.
$key_pair_id = 'APKAI3O4WVSJRO2O3K4Q';
//60 Second live time on the links that are generated.
$expires = time() + 60;
$canned_policy = '{"Statement":[{"Resource":"' . $mediaFilePath . '","Condition":{"DateLessThan":{"AWS:EpochTime":' . $expires . '}}}]}';
// sign the canned policy
$signature = rsa_sha1_sign($canned_policy, $private_key_filename);
// make the signature safe to be included in a url
$encoded_signature = url_safe_base64_encode($signature);
// combine the above into a stream name
$stream_name = create_stream_name($mediaFilePath, null, $encoded_signature, $key_pair_id, $expires);
// url-encode the query string characters to work around a flash player bug
//return 'https://cdn.ro5635.co.uk/'. encode_query_params($stream_name);
return $stream_name;
}
