事件回调签名计算

更新时间：2025-08-22

如果在事件回调设置中开启了签名设置，则VOD服务会在发送事件回调请求时，附加特定的header内容，开发者可以在回调接收端验证签名的合法性，如果通过签名算法计算的签名结果与请求header中的签名一致，则可以认为事件回调VOD服务发出的，否则可能是第三方恶意请求，开发者可以拒绝请求。

以下用一个例子来说明。

某用户在VOD开启了回调签名，签名密钥为qwer1234，事件回调的URL为http://www.example.com/callback ，该用户的百度云账号ID为e95e33a028bd49dbb3e08f068dc975d5。

VOD服务在发送的一个媒资上传完成事件回调请求大致如下：

Http

1POST /callback HTTP/1.1
2accept: */*
3content-length: 594
4host: www.example.com
5user-agent: AHC/2.0
6vod-callback-auth-timestamp: 1731317262714
7vod-callback-auth-token: 900dcab1a5227dbb47a0893d85c9447490c4d2ba6d13ca881886372e9ec2a8aa
8vod-callback-auth-user: e95e33a028bd49dbb3e08f068dc975d5
9
10{"eventId":"evt-ekkti4ep2mk0gedf","eventType":"MEDIA_UPLOAD_COMPLETE","eventTime":"2024-11-11T09:27:41Z","mediaUploadCompleteEvent":{"mediaId":"mda-ekkt369ihnhei80d","name":"test1","description":"","mediaType":"video","banSt
11atus":"NORMAL","createTime":"2024-11-11T09:27:41Z","source":{"sourceType":"UPLOAD","sourceUrl":"https://vod.example.com/mda-ekkt369ihnhei80d/test1.mp4"}}}

可以注意到，有3个特殊的header：

vod-callback-auth-user：用户百度云账号ID
vod-callback-auth-timestamp：VOD发送回调时的时间戳
vod-callback-auth-token：VOD计算的签名结果值

vod-callback-auth-token的计算方法如下：

Plain Text

1content = CONCAT('POST;', {callbackUrl}, ';', {body}, ';', {vod-callback-auth-timestamp}, ';', {vod-callback-auth-user})
2vod-callback-auth-token = SHA256-HEX(token, content)

content是一个字符串拼接的结果，{callbackUrl}是回调地址，{body}是回调请求body进行json压缩后的字符串，{vod-callback-auth-timestamp}和{vod-callback-auth-user}是特定请求头， SHA256-HEX是一个Hash算法，详见rfc4868。

为了便于用户开发，下面将给出Java实现的计算vod-callback-auth-token的方法，其他语言版本可以自行实现。

                Java
                
            

                import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Hex;

public class VodEventCallbackTokenUtil {

    private static final String HMAC_SHA256 = "HmacSHA256";
    private static final Charset CHARSET_UTF8 = StandardCharsets.UTF_8;

    public static String calculateToken(String signKey, String input) {
        byte[] secretKeyBytes = signKey.getBytes(CHARSET_UTF8);
        byte[] inputBytes = input.getBytes(CHARSET_UTF8);
        SecretKeySpec secretKeySpec = new SecretKeySpec(secretKeyBytes, HMAC_SHA256);
        try {
            Mac mac = Mac.getInstance(secretKeySpec.getAlgorithm());
            mac.init(secretKeySpec);
            mac.update(inputBytes, 0, inputBytes.length);
            byte[] macBytes = mac.doFinal();
            return String.valueOf(Hex.encodeHex(macBytes));
        } catch (NoSuchAlgorithmException | InvalidKeyException ex) {
            throw new RuntimeException(ex);
        }
    }

    public static void main(String[] args) {
        String callbackUrl = "http://www.example.com/callback";
        String signKey = "qwer1234";
        String userId = "e95e33a028bd49dbb3e08f068dc975d5";
        String timestamp = "1731317262714";
        String body = "{\"eventId\":\"evt-ekkti4ep2mk0gedf\",\"eventType\":\"MEDIA_UPLOAD_COMPLETE\",\"eventTime\":\"2024-11-11T09:27:41Z\","
                      + "\"mediaUploadCompleteEvent\":{\"mediaId\":\"mda-ekkt369ihnhei80d\",\"name\":\"test1\",\"description\":\"\",\"mediaType\":\"video\",\"banSt\n"
                      + "atus\":\"NORMAL\",\"createTime\":\"2024-11-11T09:27:41Z\",\"source\":{\"sourceType\":\"UPLOAD\",\"sourceUrl\":\"https://vod.example"
                      + ".com/mda-ekkt369ihnhei80d/test1.mp4\"}}}";
        String content = String.format("POST;%s;%s;%s;%s", callbackUrl, body, timestamp, userId);
        String auth = calculateToken(signKey, content);
        System.out.println(auth); // 输出结果 900dcab1a5227dbb47a0893d85c9447490c4d2ba6d13ca881886372e9ec2a8aa
    }

}
            

媒资抽帧完成

视频云剪辑任务状态变更

智能点播平台 VOD

智能点播平台 VOD

事件回调签名计算