DocsICP FilingConsole
Documentation
Home Page Object Storage Service User Guide Support Error codes Error codes 02-AUTH 0002-00000119

0002-00000119

Updated at:
Copy as MD
Product
My Favorites

Problem description

A signature mismatch error occurred for a request that has IP address restrictions.

Causes

You sent a request that uses a V2 signature and includes IP address restrictions. However, the signature in the request does not match the signature calculated by OSS.

Examples

You sent a request that uses a V2 signature and includes the x-oss-ac-subnet-mask header to restrict IP addresses. However, the signature provided in the request is invalid.

GET /oss.jpg?x-oss-signature-verion=OSS2&x-oss-access-key-id=nz2pc56s936****&x-oss-expires=1141889120&x-oss-ac-subnet-mask=32&x-oss-signature=InvlidSignature HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Fri, 24 Feb 2012 06:38:30 GMT

Solutions

  • If the request parameters include IP address restrictions, check whether the request is sent from a specified IP address or address range.

  • Use a software development kit (SDK) to send the request. SDKs automatically handle V2 signing. For more information, see Overview of sending requests using an SDK.

    If a signature mismatch error occurs after you send a request using an SDK, troubleshoot the issue as follows:

    1. Check whether the endpoint is in the correct format.

      For the China (Hangzhou) region, the correct endpoint is http://oss-cn-hangzhou.aliyuncs.com. For more information about the endpoints of other regions, see Regions and endpoints.

    2. Check whether the AccessKey ID and AccessKey secret are valid.

      The AccessKey ID and AccessKey secret cannot start or end with spaces.

    3. Make sure that the bucket name and ObjectKey meet the naming conventions.

      • The naming conventions for bucket names are as follows:

        • Bucket names must be globally unique in OSS.

        • The name can contain only lowercase letters, digits, and hyphens (-).

        • The name must start and end with a lowercase letter or a digit.

        • The name must be 3 to 63 characters in length.

      • The naming conventions for object keys are as follows:

        • Use UTF-8 encoding.

        • The length must be from 1 to 1023 bytes.

        • The name cannot start with a forward slash (/) or a backslash (\).

        • The name is case-sensitive.

    4. Check the signature method.

      • If you calculate signatures yourself in an environment that supports SDKs, use the signature method provided by the OSS SDK. For more information, see Overview of initiating requests using SDKs.

      • If you calculate signatures yourself in an environment that does not support SDKs, you must write code to calculate signatures and add them to REST API requests. For more information, see Overview.

    5. Check whether additional headers are added to the proxy.

  • Implement the signature yourself.

    • To implement the V2 signature yourself, you can refer to the V2 signature implementation in an official SDK. For an example, see the Python SDK V2 signature implementation.

    • To implement the signing logic yourself, you can refer to the V1 signature documentation. For more information, see Overview.

    When you implement the signature yourself, if the server returns the StringToSign string in the response, check whether the StringToSign string from the server matches the string that you generated for signing.

Previous：0002-00000118Next：0002-00000201