DocsICP FilingConsole
Documentation
Home Page Object Storage Service User Guide Support Error codes Error codes 02-AUTH 0002-00000119

0002-00000119

Updated at:
Copy as MD
Product
My Favorites

Problem description

The signature that includes IP address restrictions does not match the signature calculated by Object Storage Service (OSS).

Causes

The request uses the V2 signature (OSS2) and restricts IP addresses via the oss-ac-subnet-mask header, but the computed signature does not match what OSS recalculates on the server side.

Examples

The V2 signature is used in the request and the oss-ac-subnet-mask header is specified to restrict IP addresses. However, the signature in the request does not match the signature calculated by OSS.

GET /oss.jpg?x-oss-signature-verion=OSS2&x-oss-access-key-id=nz2pc56s936****&x-oss-expires=1141889120&x-oss-ac-subnet-mask=32&x-oss-signature=InvlidSignature HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Fri, 24 Feb 2012 06:38:30 GMT

Solutions

Work through the following checks in order. Most signature mismatches fall into one of these categories: IP restriction mismatch, invalid endpoint, bad credentials, naming violations, incorrect signature method, or proxy interference.

1. Verify the IP address restriction

If the request includes IP address restrictions, confirm that the source IP address belongs to the specified IP addresses or CIDR blocks set in oss-ac-subnet-mask.

2. Use the Alibaba Cloud OSS SDK for V2 signature requests

If your environment supports it, use an Alibaba Cloud OSS SDK to handle V2 signature generation rather than signing manually. See Overview.

3. Troubleshoot SDK-based requests

If you are using an Alibaba Cloud OSS SDK and still get a signature mismatch, check the following:

  1. Endpoint format — Confirm the endpoint is valid. For the China (Hangzhou) region, the correct format is:

    http://oss-cn-hangzhou.aliyuncs.com

    For other regions, see Regions and endpoints.

  2. Credentials — Confirm that the AccessKey ID and AccessKey secret are correct and contain no leading or trailing spaces.

  3. Bucket and object naming — Confirm that your bucket and object names meet OSS naming conventions:

    Bucket names:

    • Unique across OSS

    • Contain only lowercase letters, digits, and hyphens (-)

    • Start and end with a lowercase letter or digit

    • 3–63 characters in length

    Object names:

    • Encoded in UTF-8

    • 1–1,023 bytes in length

    • Do not start with a forward slash (/) or backslash (\\)

    • Case-sensitive

  4. Signature method — Confirm you are using the correct signing approach:

    • SDK available: Use the signature method provided by the SDK. See Overview.

    • No SDK available: Write code to compute the signature and add it to the RESTful API request. See Overview.

  5. Proxy server headers — Check whether the proxy server is injecting additional headers into the request.

4. Manually sign requests (no SDK)

If you are computing the V2 signature without an SDK:

  • Python SDK reference implementation: See oss2/auth.py#L302 for how OSS calculates the V2 signature.

  • Signature specification: See Overview.

5. Compare the StringToSign value

If the OSS error response includes the StringToSign parameter, extract it and compare it against the string you computed before signing to check whether the values match.

Previous：0002-00000118Next：0002-00000201