0002-00000006

Problem description

The security token included in the request is invalid.

Causes

The request uses Security Token Service (STS) access credentials to access OSS, but the security token in the request does not match the token issued by STS. Two common scenarios:

• URL-based signing: The security-token query parameter in the signed URL contains a token that differs from the one returned by the AssumeRole operation.

• Header-based signing: The x-oss-security-token request header contains a token that differs from the one returned by the AssumeRole operation.

Examples

The AccessKey ID obtained from STS is used in the request URL, but the security-token parameter contains a token that is inconsistent with the one obtained from STS:

https://examplebucket.oss-cn-hangzhou.aliyuncs.com/oss-api.pdf?OSSAccessKeyId=STS.nz2pc56s936****&Expires=1141889120&Signature=vjbyPxybdZaNmGa%2ByT272YEAiv****&security-token=CAISowJ1q6Ft5B2yfSjIr5bgIOz31blR9oWmWBfCs3kDR/xm3Imc1zz2IHxMdHJsCeAcs/Q0lGFR5/sflqJIRoReREvCUcZr8szfWcsZos2T1fau5Jko1be0ewHKeQKZsebWZ+LmNpy/Ht6md1HDkAJq3LL+bk/Mdle5MJqP+/kFC9MMRVuAcCZhDtVbLRcYgq18D3bKMuu3ORPHm3fZCFES2jBxkmRi86+ysIP+phPVlw/90fRH5dazcJW0Zsx0OJo6Wcq+3+FqM6DQlTNM6hwNtoUO1fYUommb54nDXwQIvUjfbtC5qIM/cFVLAYEhALNBofTGkvl1h/fejYyfyWwWYbkFCHiPFNr9kJCUSbr4a4sjF6zyPnPWycyCLYXleLzhxPWd/2kagAGaXG69BqwYNvrKKI3W8weP3bNc1wQDMXQfiHpFCRG6lYhh3iXFtpwH90A3sTlxzRGvi8+9p63JwrluOHWs+Fj6S6s0cOhKvKRWYE8UuWeXIvv4l6DAGwHDE8BLjLC11f5prUJgI2wb+3hwuBod32Jx+us/1p996Glao725orcb****

The AccessKey ID obtained from STS is used in the request headers, but the x-oss-security-token header contains a token that is inconsistent with the one obtained from STS.

Solutions

To fix this error, get a fresh set of temporary credentials from STS and use them in your request.

Step 1: Get temporary credentials from STS.

Call the AssumeRole operation or use an STS SDK to get temporary access credentials. Temporary access credentials contain a security token and a temporary AccessKey pair that consists of an AccessKey ID and an AccessKey secret. For details, see Use temporary credentials provided by STS to access OSS.

Step 2: Use an SDK or call the RESTful API to initiate a request using the STS credentials.

When constructing the request, make sure the security token is from the same STS response as the AccessKey pair.