0002-00000101

Problem description

The request signature does not match.

Causes

The request uses a V2 signature, but the signature provided in the request does not match the signature calculated by OSS.

Examples

You initiated a request that uses a V2 signature, but the signature was calculated incorrectly:

GET /oss.jpg?x-oss-signature-verion=OSS2&x-oss-access-key-id=nz2pc56s936****&x-oss-expires=1141889120&x-oss-signature=InvlidSignature HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT

Solutions

• You can use a Software Development Kit (SDK) to initiate a request that uses a V2 signature. For more information, see Overview of initiating requests using SDKs.

  If a signature mismatch error is reported after you use an SDK to initiate a request, follow these steps to troubleshoot the issue:

  1. Check whether the endpoint is in the correct format.

     For the China (Hangzhou) region, the correct endpoint is http://oss-cn-hangzhou.aliyuncs.com. For more information about the endpoints of other regions, see Regions and endpoints.

  2. Check whether the AccessKey ID and AccessKey secret are valid.

     The AccessKey ID and AccessKey secret cannot start or end with spaces.

  3. Make sure that the bucket name and ObjectKey meet the naming conventions.

     • The naming conventions for bucket names are as follows:

       • Bucket names must be globally unique in OSS.

       • The name can contain only lowercase letters, digits, and hyphens (-).

       • The name must start and end with a lowercase letter or a digit.

       • The name must be 3 to 63 characters in length.

     • The naming conventions for object keys are as follows:

       • Use UTF-8 encoding.

       • The length must be from 1 to 1023 bytes.

       • The name cannot start with a forward slash (/) or a backslash (\).

       • The name is case-sensitive.

  4. Check the signature method.

     • If you calculate signatures yourself in an environment that supports SDKs, use the signature method provided by the OSS SDK. For more information, see Overview of initiating requests using SDKs.

     • If you calculate signatures yourself in an environment that does not support SDKs, you must write code to calculate signatures and add them to REST API requests. For more information, see Overview.

  5. Check whether additional headers are added to the proxy.

• You can implement the signature yourself.

  • To implement V2 signing yourself, you can refer to the V2 signing implementation in the SDK. For more information, see V2 signature implementation in OSS SDK for Python.

  • To implement the signing logic yourself, you can refer to V1 signing. For more information, see Overview.

  When you implement the signature using these methods, if the server returns a StringToSign string in the response, check whether the server-side string-to-sign is the same as the one you used for signing.