Amazon API request with delphi: Got HTTP / 1.1 403 Forbidden

Question

I do not know if my code is correct or incorrect. when I try to run a software error, 403 occurs ..

unit Unit1; interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs,ssbase64, StdCtrls,secutils,OmniXMLUtils,OmniXML, xmldom, XMLIntf, msxmldom, XMLDoc, IdBaseComponent, IdComponent, IdTCPConnection, IdTCPClient, IdHTTP,IdURI; type TForm1 = class(TForm) Button1: TButton; Memo1: TMemo; XMLDocument1: TXMLDocument; IdHTTP1: TIdHTTP; Memo2: TMemo; Memo3: TMemo; procedure Button1Click(Sender: TObject); private { Private declarations } public { Public declarations } end; var Form1: TForm1; implementation {$R *.dfm} function MyEncodeUrl(source:string):string; var i:integer; begin result := ''; for i := 1 to length(source) do if not (source[i] in ['A'..'Z','a'..'z','0','1'..'9','-','_','~','.']) then result := result + '%'+inttohex(ord(source[i]),2) else result := result + source[i]; end; procedure TForm1.Button1Click(Sender: TObject); var uhost,uri,public_key, private_key,signature,timestamp,string_to_sign : string; request : String; begin uhost := 'ecs.amazonaws.com'; uri := 'onca/xml'; public_key := '1ETPTJHQ37P671HNXXX'; private_key := 'j4JtMHQwL6wR39fy2CJgNfHibLjK9GsC5Z6XXXX'; timestamp := MyEncodeUrl(XMLDateTimeToStr(now)); string_to_sign := 'AWSAccessKeyId=1ETPTJHQ37P671HN9282'; string_to_sign := string_to_sign+ '&AssociateTag=moc-20&ItemPage=1&Keywords=kitchen%20aid&Operation=ItemSearch&ResponseGroup=Large&SearchIndex=Kitchen&'; string_to_sign := string_to_sign+'service=AWSECommerceService&Timestamp='+timestamp; string_to_sign := string_to_sign+'&Version=2009-03-31'; Memo1.Clear; Memo1.Lines.Append('GET'); Memo1.Lines.Append('ecs.amazonaws.com'); Memo1.Lines.Append('/onca/xml'); Memo1.Lines.Append(string_to_sign); signature := StrToMime64(HMACString(haSHA256, private_key, 32, Memo1.Text)); request := 'http://ecs.amazonaws.com/onca/xml?AWSAccessKeyId=1ETPTJHQ37P671HN9282'; request := request+ '&AssociateTag=moc-20&ItemPage=1&Keywords=kitchen%20aid&Operation=ItemSearch&ResponseGroup=Large&SearchIndex=Kitchen&'; request := request+'service=AWSECommerceService&Timestamp='+timestamp; request := request+'&Version=2009-03-31'; request := request+'&Signature='+signature; Memo1.Text := IdHTTP1.Get(request); end; end. 

can anyone track my mistake?

 FYI :: Delphi 7 with build in Indy; use OmniXML to generate timestamp use OpenStrSecII to generate signature 

Answer 1

Amazon sends back an XML document that describes exactly why you got 403. The easiest way to see the message is to use Fiddler and configure your Indy HTTP to use 127.0.0.1 as a proxy. Thus, all your traffic goes through Fiddler, and you will see both what you sent and the fact that Amazon returned.

When I applied my REST API to work with Amazon S3, I had problems defining the “Canonical Headers” that needed to be signed. Fortunately, the Amazon API sends you the text that they sign to verify your signature, so you can compare this byte by byte and see if you are mistaken. Failure to prepare these “canonical headings” just as they prepare these headings will obviously result in 403 . For example, the Amazon line separator uses LINEFEED ( #10 ). Since you put your headers in TMemo , you get a Windows-style CRLF delimiter. This is enough for your code to fail.

I had problems sending extra headers with Indy requests. I followed the API patterns on the Internet, looking at what I had to send and what Amazon should respond to. Fiddler was the only way to experience and see what I send, unlike what I thought I was sending. For example, I mistakenly used TIdHttp.Request.RawHeaders to write my custom headers, but these headers are reset during the preparation of the Request. I should have written my TIdHttp.Request.CustomHeaders headers, but without the help of Fiddler I would not have known that I did not actually send my headers. My code looked just fine.