0002-00000075-Object Storage Service(OSS)-阿里云帮助中心

Problem description

The Signature field in the signed URL is blank.

Causes

The request uses URL-based signing, but the Signature field in the URL parameter is left empty.

A signed URL grants temporary access to an OSS object without exposing credentials. Every signed URL requires the following three query parameters:

Parameter	Mandatory	Description
`OSSAccessKeyId`	Yes	The Access Key ID of the request issuer.
`Expires`	Yes	The UNIX timestamp at which the URL expires.
`Signature`	Yes	The HMAC-SHA1 signature calculated from the Access Key Secret and the canonicalized request string.

If any of these parameters is missing or blank, OSS rejects the request.

Examples

The following request has a blank Signature field:

GET /test.txt?OSSAccessKeyId=nz2p****&Expires=1141889120&Signature= HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com

Calculate Signature using this formula:

Signature = urlencode(base64(hmac-sha1(AccessKeySecret,
          VERB + "\n"
          + CONTENT-MD5 + "\n"
          + CONTENT-TYPE + "\n"
          + EXPIRES + "\n"
          + CanonicalizedOSSHeaders
          + CanonicalizedResource)))

Solutions

Add a correctly calculated Signature value to the URL. A valid request looks like this:

GET /test.txt?OSSAccessKeyId=nz2p****&Expires=1141889120&Signature=vjbyPxybdZaNmGa%2ByT272YEAiv**** HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com

If the signature is still rejected after adding a value, verify the following:

Item	What to check
`AccessKeySecret`	The secret used to sign must match the `OSSAccessKeyId` in the URL.
HTTP verb	The `VERB` component must match the HTTP method of the request (for example, `GET`).
`Expires` value	The `EXPIRES` component in the signing string must match the `Expires` query parameter, and the expiry time must be in the future.
URL encoding	The calculated signature must be URL-encoded before it is appended to the URL. For example, `+` must be encoded as `%2B`.
`CanonicalizedOSSHeaders`	The headers in the signing string must match the headers sent with the request.
`CanonicalizedResource`	The resource path must match the object path in the request.

For the full signing specification, see Add signatures to URLs.

Note

Use Alibaba Cloud SDKs to generate signed URLs. SDKs calculate and URL-encode the signature automatically. For more information, see Overview.