Object Storage Service:Data security

Usage notes

• In this topic, the public endpoint of the China (Hangzhou) region is used. If you want to access OSS by using other Alibaba Cloud services in the same region as OSS, use an internal endpoint For more information about the regions and endpoints supported by OSS, see Regions and endpoints.
• In this topic, an OSSClient instance is created by using an OSS endpoint. If you want to create an OSSClient instance by using custom domain names or STS, see Create an OSSClient instance.

MD5 verification

If you configure Content-MD5 in an object upload request, OSS calculates the MD5 hash of the uploaded object. If the calculated MD5 hash is different from the MD5 hash configured in the upload request, InvalidDigest is returned. This allows OSS to ensure data integrity for object upload. If InvalidDigest is returned, you must upload the object again.

The following code provides an example on how to perform MD5 verification for object upload operations:

import com.aliyun.oss.*;
import com.aliyun.oss.common.utils.BinaryUtil;
import com.aliyun.oss.model.ObjectMetadata;
import java.io.ByteArrayInputStream;

public class Demo {
    public static void main(String[] args) throws Throwable {
        // In this example, the endpoint of the China (Hangzhou) region is used. Specify the actual endpoint. 
        String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
        // The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. 
        String accessKeyId = "yourAccessKeyId";
        String accessKeySecret = "yourAccessKeySecret";
        // Specify the name of the bucket. Example: examplebucket. 
        String bucketName = "examplebucket";
        // Specify the full path of the object. The full path cannot contain the name of the bucket. 
        String objectName = "exampledir/object";

        // Create an OSSClient instance. 
        OSS ossClient = new OSSClientBuilder().build(endpoint, accessKeyId, accessKeySecret);

        try {
            // Upload a string. 
            String content = "Hello OSS";

            ObjectMetadata meta = new ObjectMetadata();
            // Configure MD5 verification. 
            String md5 = BinaryUtil.toBase64String(BinaryUtil.calculateMd5(content.getBytes()));
            meta.setContentMD5(md5);

            ossClient.putObject(bucketName, objectName, new ByteArrayInputStream(content.getBytes()), meta);

        } catch (OSSException oe) {
            System.out.println("Caught an OSSException, which means your request made it to OSS, "
                    + "but was rejected with an error response for some reason.");
            System.out.println("Error Message:" + oe.getErrorMessage());
            System.out.println("Error Code:" + oe.getErrorCode());
            System.out.println("Request ID:" + oe.getRequestId());
            System.out.println("Host ID:" + oe.getHostId());
        } catch (ClientException ce) {
            System.out.println("Caught an ClientException, which means the client encountered "
                    + "a serious internal problem while trying to communicate with OSS, "
                    + "such as not being able to access the network.");
            System.out.println("Error Message:" + ce.getMessage());
        } finally {
            if (ossClient != null) {
                ossClient.shutdown();
            }
        }
    }
}            

CRC-64

By default, CRC-64 is enabled to ensure data integrity when you upload, download, and copy an object.

• CRC-64 in object download

  The following code provides an example on how to perform CRC-64 when you download an object:

  import com.aliyun.oss.*;
  import com.aliyun.oss.common.utils.IOUtils;
  import com.aliyun.oss.internal.OSSHeaders;
  import com.aliyun.oss.internal.OSSUtils;
  import com.aliyun.oss.model.GetObjectRequest;
  import com.aliyun.oss.model.OSSObject;
  import java.io.BufferedReader;
  import java.io.InputStreamReader;
  
  public class Demo {
      public static void main(String[] args) throws Throwable {
          // In this example, the endpoint of the China (Hangzhou) region is used. Specify your actual endpoint. 
          String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
          // The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. 
          String accessKeyId = "yourAccessKeyId";
          String accessKeySecret = "yourAccessKeySecret";
          // Specify the name of the bucket. Example: examplebucket. 
          String bucketName = "examplebucket";
          // Specify the full path of the object. Do not include the bucket name in the full path. 
          String objectName = "exampledir/object";
  
          // Create an OSSClient instance. 
          OSS ossClient = new OSSClientBuilder().build(endpoint, accessKeyId, accessKeySecret);
  
          try {
              // Download the object in streaming mode. 
              GetObjectRequest getObjectRequest = new GetObjectRequest(bucketName, objectName);
              OSSObject ossObject = ossClient.getObject(bucketName, objectName);
  
              // Read the object from the stream to obtain clientCRC. 
              System.out.println("Object content:");
              BufferedReader reader = new BufferedReader(new InputStreamReader(ossObject.getObjectContent()));
              while (true) {
                  String line = reader.readLine();
                  if (line == null) break;
  
                  System.out.println("\n" + line);
              }
              // You must close the obtained stream after the object is read. Otherwise, connection leaks may occur. Consequently, no connections are available and an exception occurs. 
              reader.close();
  
              // Check whether CRC-64 is enabled on the client. By default, CRC-64 is enabled on the client. 
              Boolean isCrcCheckEnabled = ((OSSClient)ossClient).getClientConfiguration().isCrcCheckEnabled();
              // Check whether the download quest is a range download request. CRC-64 is not supported in range download. 
              Boolean isRangGetRequest = getObjectRequest.getHeaders().get(OSSHeaders.RANGE) != null;
  
              // Check whether the CRC-64 value in the returned result is the same as that of the downloaded object. 
              if (isCrcCheckEnabled && !isRangGetRequest) {
                  Long clientCRC = IOUtils.getCRCValue(ossObject.getObjectContent());
                  OSSUtils.checkChecksum(clientCRC, ossObject.getServerCRC(), ossObject.getRequestId());
              }
          } catch (OSSException oe) {
              System.out.println("Caught an OSSException, which means your request made it to OSS, "
                      + "but was rejected with an error response for some reason.");
              System.out.println("Error Message:" + oe.getErrorMessage());
              System.out.println("Error Code:" + oe.getErrorCode());
              System.out.println("Request ID:" + oe.getRequestId());
              System.out.println("Host ID:" + oe.getHostId());
          } catch (ClientException ce) {
              System.out.println("Caught an ClientException, which means the client encountered "
                      + "a serious internal problem while trying to communicate with OSS, "
                      + "such as not being able to access the network.");
              System.out.println("Error Message:" + ce.getMessage());
          } finally {
              if (ossClient != null) {
                  ossClient.shutdown();
              }
          }
      }
  }

• CRC-64 in append upload

  The following code provides an example on how to perform CRC-64 when you upload an object by using append upload:

  import com.aliyun.oss.ClientException;
  import com.aliyun.oss.OSS;
  import com.aliyun.oss.OSSClientBuilder;
  import com.aliyun.oss.OSSException;
  import com.aliyun.oss.model.*;
  import java.io.ByteArrayInputStream;
  
  public class Demo {
      public static void main(String[] args) throws Exception {
          // In this example, the endpoint of the China (Hangzhou) region is used. Specify your actual endpoint. 
          String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
          // The AccessKey pair of an Alibaba Cloud account has permissions on all API operations. Using these credentials to perform operations in OSS is a high-risk operation. We recommend that you use a RAM user to call API operations or perform routine O&M. To create a RAM user, log on to the RAM console. 
          String accessKeyId = "yourAccessKeyId";
          String accessKeySecret = "yourAccessKeySecret";
          // Specify the name of the bucket. Example: examplebucket. 
          String bucketName = "examplebucket";
          // Specify the full path of the object. Example: exampleobject.txt. Do not include the bucket name in the full path. 
          String objectName = "exampleobject.txt";
          // Enter the content of the first append upload, such as Hello. 
          String firstAppendContent = "Hello";
          // Enter the content of the second append upload, such as World. 
          String secondAppendContent = "World";
  
          // Create an OSSClient instance. 
          OSS ossClient = new OSSClientBuilder().build(endpoint, accessKeyId, accessKeySecret);
  
          try {
              // Start the first append. 
              AppendObjectRequest appendObjectRequest = new AppendObjectRequest(bucketName, objectName, new ByteArrayInputStream(firstAppendContent.getBytes()));
              appendObjectRequest.setPosition(0L);
              // Set the initial CRC-64 value. Then OSS SDK for Java performs CRC-64 on the uploaded content by default. 
              appendObjectRequest.setInitCRC(0L);
              AppendObjectResult appendObjectResult = ossClient.appendObject(appendObjectRequest);
  
              // Perform the second append upload operation. 
              appendObjectRequest = new AppendObjectRequest(bucketName, objectName, new ByteArrayInputStream(secondAppendContent.getBytes()));
              appendObjectRequest.setPosition(appendObjectResult.getNextPosition());
              // Set the CRC-64 value to that of the uploaded object. Then OSS SDK for Java performs CRC-64 on the uploaded content by default. 
              appendObjectRequest.setInitCRC(appendObjectResult.getClientCRC());
              ossClient.appendObject(appendObjectRequest);
          } catch (OSSException oe) {
              System.out.println("Caught an OSSException, which means your request made it to OSS, "
                      + "but was rejected with an error response for some reason.");
              System.out.println("Error Message:" + oe.getErrorMessage());
              System.out.println("Error Code:" + oe.getErrorCode());
              System.out.println("Request ID:" + oe.getRequestId());
              System.out.println("Host ID:" + oe.getHostId());
          } catch (ClientException ce) {
              System.out.println("Caught an ClientException, which means the client encountered "
                      + "a serious internal problem while trying to communicate with OSS, "
                      + "such as not being able to access the network.");
              System.out.println("Error Message:" + ce.getMessage());
          } finally {
              if (ossClient != null) {
                  ossClient.shutdown();
              }
          }
      }
  }

References

For more information about the complete sample code for MD5 verification and CRC-64, visit GitHub.