How to upload file to Storage without login

In order to upload file to Storage without login google account, we have to implement policy document. After that, user can upload file to Storage from web page via Form directly.

There are 4 rough steps:

1. Service Account p12 file, it can be created at GCP Console 
2. Uploading object metadata, including
1. Bucket
2. Key
3. ACL
4. Expiration, for more information: Policy Document
3. encryption
4. fill above info to Form, upload file

Step One：p12 file

After login GCP Console, you can generate p12 file via API Manager -> Credentials -> Create credentials

Only Storage Admin assigned because we utilize Storage service only. If you need more permissions for other services, please refer available roles.

Please save your p12 file properly because there is only one chance to download the file.

Step Two：uploading object metadata

According to Policy Document, JSON format is required for uploading object metadata. There are two major parts: 

1. expiration：policy document expiration time (ISO8601 format), when sign a policy document, it required to specify available period and it will expired after specified time.
2. conditions：metadata to describe uploading object 

example：

{"expiration":"2017-04-24T11:11:51+02:00", 

 "conditions":[{"bucket":"upload"}, {"key":"myimg.png"}]}

PHP Sample Code

Step Three：encryption

Please follow encryption order carefully and confirm p12 file path is correct.

1. policy must be utf-8 encoded => policy_utf
2. Base64 encode (policy_utf) => policy_base64
3. SHA256( RSA (Secret Key, policy_base64)) => singed
4. Base64 encode (signed) => signature

PHP Sample Code

Step Four：fill above info into Form, upload file
After above steps, policy (policy_base64) and signature have been generated. Those two informations must be filled into Form. Besides, for metadata specified in policy conditions, it must be filled into Form also. It is very important and it will cause uploading fail if those informations do not fill into Form.
PHP Sample Code

• action：fill <bucket>.storage.googleapis.com, remember to replace <bucket> name, such as upload.storage.googleapis.com
• method：POST 
• enctype：multipart/form-data 
• GoogleAccessId：replace your service account created in step one

github link