0002-00000077

Problem description

The x-oss-additional-headers parameter in a signed URL lists header fields that are not present in the actual request.

Causes

When OSS verifies a signed URL request, it checks that every header listed in x-oss-additional-headers is included in the request. If any listed header is missing or does not exist in the request, OSS rejects the request with this error.

Examples

The following request fails because x-oss-additional-headers contains ;host — a value starting with a space, which makes it an invalid field value.

GET /test.txt?x-oss-signature-version=OSS2&x-oss-additional-headers= ;host&x-oss-access-key-id=44CF9***&x-oss-expires=1475462111&x-oss-signature=abc*** HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Range: bytes=100-900

Solutions

Choose one of the following options:

Option 1: Remove x-oss-additional-headers

x-oss-additional-headers is optional. If you do not need extra headers included in the signature calculation, remove this parameter from the signed URL.

Option 2: Set a valid value for x-oss-additional-headers

If you want extra headers included in the signature, construct the x-oss-additional-headers value according to these rules:

• All header names must be lowercase.

• Headers must be sorted in ascending alphabetical order.

• Separate multiple headers with semicolons (;).

For the example request above, the Host and Range headers are present. Set x-oss-additional-headers to host;range.

The corrected request looks like this:

GET /test.txt?x-oss-signature-version=OSS2&x-oss-additional-headers=host;range&x-oss-access-key-id=44CF9***&x-oss-expires=1475462111&x-oss-signature=abc*** HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Range: bytes=100-900