Using versioning with signed urls in google cloud storage

Question

I'm having difficulty signing GET requests for Google Cloud Storage (GCS) when specifying a 'generation' (version number) on a the object. Signing the URL without the generation works like a charm and GET requests work fine. However, when I prepend #generation to the path, the GCS server always returns "access denied" when attempting to GET the signed URL.

For example, signing this URL path works fine:

https://storage.googleapis.com/BUCKET/OBJECT

signing this URL path gives me access denied:

https://storage.googleapis.com/BUCKET/OBJECT#1360887697105000

Note that for brevity and privacy, I've omitted what the actual signed URL with Signature, Expires, GoogleAccessId parameters. Also note, that I have also verified the bucket, object, and generation are correct using gsutil.

Does GCS allow for Signed URL access to specific object versions by 'generation' number? Is the URL signing procedure different when accessing a specific version?

Answer 1

The URL you're using is gsutil-compatible, but the XML API requires that you denote generation with a query parameter (which would look like storage.googleapis.com/BUCKET/OBJECT?generation=1360887697105000).

Documentation is here for reference: developers.google.com/storage/docs/reference-headers#generation