0002-00000103-Object Storage Service(OSS)-阿里云帮助中心

Issue description

The format of the Authorization request header is invalid.

Causes

You initiated a request that uses the V2 signature, but the format of the Authorization header is invalid.

Examples

You initiated a request that uses the V2 signature, but the format of the Authorization header is invalid.

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS2 AccessKeyId:44**07,AdditionalHeadershost,Signature:n7I**I0=

The Authorization header separates the signature version and signature information with a space.

Signature version: Only OSS2 is supported.
Signature information: The signature information is displayed in the form of key-value pairs (key:value). Separate key-value pairs with commas (,) and separate keys and values with colon (:).

The key of the signature information includes two required fields (AccessKeyId and Signature) and one optional field (AdditionalHeaders). In the preceding example, the colon between the key (AdditionalHeaders) and the value (host) in the AdditionalHeadershost key-value pair is missing.

Solutions

Make sure that the format of the Authorization header in the request that uses the V2 signature meets the preceding requirements. Example:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS2 AccessKeyId:44**07,AdditionalHeaders:host,Signature:n7I**I0=

References

If you want to use Alibaba Cloud SDKs to initiate a request that uses the V2 signature, see Overview.
You can implement the signature yourself.
- To implement V2 signing yourself, you can refer to the V2 signing implementation in the SDK. For more information, see V2 signature implementation in OSS SDK for Python.
- To implement the signing logic yourself, you can refer to V1 signing. For more information, see Overview.
When you implement the signature using these methods, if the server returns a StringToSign string in the response, check whether the server-side string-to-sign is the same as the one you used for signing.