Problem description
The Authorization header in your V4 signature request is malformed.
Causes
The request uses V4 signature (OSS4-HMAC-SHA256), but the Authorization header is not formatted correctly. The most common cause is a missing = between a key and its value in the signature information — for example, CredentialAK... instead of Credential=AK....
The Authorization header must follow this format:
OSS4-HMAC-SHA256 Credential=<value>,AdditionalHeaders=<value>,Signature=<value>Format rules:
Separate the signature version from the signature information with a space.
Separate key-value pairs in the signature information with commas (
,).Connect each key and value with an equal sign (
=).Signature version: Only
OSS4-HMAC-SHA256is supported.
The signature information contains these fields:
| Field | Required | Description |
|---|---|---|
Credential | Yes | Your access key ID followed by the credential scope: <AccessKeyID>/<date>/<region>/oss/aliyun_v4_request |
Signature | Yes | The computed HMAC-SHA256 signature. |
AdditionalHeaders | No | A list of additional signed headers. |
Examples
The following example shows a malformed Authorization header where the = after Credential is missing:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 CredentialAK**ID/20221220/us-east-1/oss/aliyun_v4_request,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOADSolutions
Fix the Authorization header so it follows the format described in the Causes section. Make sure every key-value pair uses = to connect the key and value.
The following example shows a correctly formatted Authorization header:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOADIf the server returns a response that contains the StringToSign parameter, check whether the value of the StringToSign parameter on the server is the same as the string you constructed before signing.
References
For information about how to use Alibaba Cloud SDKs to send requests that use the V4 signature, see Overview.
For information about how to calculate the V4 signature, see Calculate V4 signature by using OSS SDK for Python.
For information about the V1 signature, see Overview.