0002-00000109

Problem description

The Signature field in the Authorization request header is left empty.

Causes

You initialized a request that uses a V2 signature. However, the Signature field in the Authorization request header is left empty.

Examples

You initiated a request that uses a V2 signature. However, the Authorization request header is invalid.

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS2 AccessKeyId:44**07,AdditionalHeaders:host,Signature:

You must use a space to separate the signature version and the signature information in the Authorization request header. The following rules apply:

• Signature version: Only OSS2 is supported.

• Signature information: Specify the signature information in the format of key-value pairs. Separate key-value pairs with commas (,). Each key-value pair is in the key:value format.

  The keys of the signature information include the AccessKeyId and Signature required fields and the AdditionalHeaders optional field. In this example, the preceding fields are used as keys in the Authorization request header, but the Signature field is left empty.

Solutions

Make sure that the format of the Authorization header in the request that uses a V2 signature conforms to the preceding rules. Sample code:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS2 AccessKeyId:44**07,AdditionalHeaders:host,Signature:n7I**I0=

References

• If you want to use Alibaba Cloud SDKs to initiate a request that uses a V2 signature, see Overview.

• You can implement the signature yourself.

  • To implement V2 signing yourself, you can refer to the V2 signing implementation in the SDK. For more information, see V2 signature implementation in OSS SDK for Python.

  • To implement the signing logic yourself, you can refer to V1 signing. For more information, see Overview.

  When you implement the signature using these methods, if the server returns a StringToSign string in the response, check whether the server-side string-to-sign is the same as the one you used for signing.