0002-00000010

Problem description

A single request can't carry a security token in both the request header and the URL request parameter.

Cause

You sent an authentication request based on Security Token Service (STS) that included both the x-oss-security-token request header and the security-token URL request parameter.

Example

The following STS-based authentication request carries a security token in both the request header and the URL request parameter.

GET /oss.jpg?security-token=CAISowJ1q6Ft5B2yfSjIr5bgIOz31blR**** HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Fri, 24 Feb 2012 06:38:30 GMT
Authorization: OSS qn6q**************:77Dv****************
x-oss-security-token: CAISowJ1q6Ft5B2yfSjIr5bgIOz31blR****

Solution

Remove the security token from the URL request parameter and include it only in the request header:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Fri, 24 Feb 2012 06:38:30 GMT
Authorization: OSS qn6q**************:77Dv****************
x-amz-security-token: CAISowJ1q6Ft5B2yfSjIr5bgIOz31blR****