Problem description
The signature in the request does not match the signature calculated by Object Storage Service (OSS).
Causes
The request uses a V4 signature, but the signature value in the request does not match what OSS calculates from the same request.
Examples
The following request passes a V4 signature in the URL, but the signature is incorrect:
GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=***&x-oss-expires=118060&x-oss-additional-headers=host&x-oss-signature=InvalidSignature HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Fri, 24 Feb 2012 06:38:30 GMTSolutions
Use the StringToSign value to diagnose the mismatch
If the server returns a response that contains the StringToSign parameter, you can check whether the value of the StringToSign parameter on the server is the same as the string before calculation. Any difference reveals the exact location of the mismatch.
Use an Alibaba Cloud SDK
If your environment supports Alibaba Cloud SDKs, use the SDK's built-in signature method instead of calculating signatures manually. See Overview for supported SDKs.
If you already use an SDK but still get this error, work through the following checks:
Verify the endpoint format. For China (Hangzhou), the valid endpoint is
http://oss-cn-hangzhou.aliyuncs.com. For other regions, see Regions and endpoints.Check for leading or trailing spaces in your credentials. The AccessKey ID and AccessKey secret cannot start or end with a space.
Confirm bucket and object names follow OSS naming rules.
Bucket names:
Must be unique in OSS
Can contain lowercase letters, digits, and hyphens (-)
Must start and end with a lowercase letter or digit
Must be 3–63 characters long
Object names:
Must be encoded in UTF-8
Must be 1–1,023 bytes long
Cannot start with a forward slash (/) or a backslash (\)
Are case-sensitive
Check the signature method.
If you use the self-signed mode and your business environment supports OSS SDKs, use the signature method provided by OSS SDKs. For more information, see Overview.
If you use the self-signed mode and your business environment does not support OSS SDKs, you must write code to calculate signatures and add the signatures to RESTful API requests. For more information, see Overview.
Check whether additional headers are added to the proxy server.
Calculate the V4 signature manually
If your environment does not support OSS SDKs and you must sign requests yourself:
For a reference implementation in Python, see the OSS SDK for Python auth module.
For the full V4 signature specification, see Overview.
Use the StringToSign value in the error response to pinpoint where your calculation diverges from what OSS expects.