0002-00000201

Problem description

A signature mismatch error occurred.

Causes

The request uses a v4 signature, but the signature provided in the request does not match the signature calculated by OSS.

Example problem

You sent a request that includes an incorrectly calculated v4 signature in the URL.

GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=***&x-oss-expires=118060&x-oss-additional-headers=host&x-oss-signature=InvalidSignature HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Fri, 24 Feb 2012 06:38:30 GMT

Solutions

• You can use an SDK to initiate a request that uses a v4 signature. For more information, see Overview of initiating requests using an SDK.

  If you receive a signature mismatch error after you initiate a request using an SDK, perform the following steps to troubleshoot the issue.

  1. Check whether the endpoint is in the correct format.

     For the China (Hangzhou) region, the correct endpoint is http://oss-cn-hangzhou.aliyuncs.com. For more information about the endpoints of other regions, see Regions and endpoints.

  2. Check whether the AccessKey ID and AccessKey secret are valid.

     The AccessKey ID and AccessKey secret cannot start or end with spaces.

  3. Make sure that the bucket name and ObjectKey meet the naming conventions.

     • The naming conventions for bucket names are as follows:

       • Bucket names must be globally unique in OSS.

       • The name can contain only lowercase letters, digits, and hyphens (-).

       • The name must start and end with a lowercase letter or a digit.

       • The name must be 3 to 63 characters in length.

     • The naming conventions for object keys are as follows:

       • Use UTF-8 encoding.

       • The length must be from 1 to 1023 bytes.

       • The name cannot start with a forward slash (/) or a backslash (\).

       • The name is case-sensitive.

  4. Check the signature method.

     • If you calculate signatures yourself in an environment that supports SDKs, use the signature method provided by the OSS SDK. For more information, see Overview of initiating requests using SDKs.

     • If you calculate signatures yourself in an environment that does not support SDKs, you must write code to calculate signatures and add them to REST API requests. For more information, see Overview.

  5. Check whether additional headers are added to the proxy.

• Implement the signature yourself.

  • To implement the v4 signature yourself, you can refer to the v4 signature implementation in the SDK. For more information, see v4 signature implementation in OSS SDK for Python.

  • To implement the signing logic yourself, you can refer to the v1 signature. For more information, see Overview.

  When you use these methods to implement the signature, if the server returns the StringToSign string in the response, verify that this string matches the one you used for signing.