Problem description
The Signature field in the Authorization header is empty.
Causes
The request uses the V4 signature (OSS4-HMAC-SHA256), but the Signature field in the Authorization header has no value (that is, Signature= with nothing after the equals sign).
A valid V4 Authorization header consists of a signature version and signature information separated by a single space:
OSS4-HMAC-SHA256 Credential=<value>,AdditionalHeaders=<value>,Signature=<value>The signature version is OSS4-HMAC-SHA256 (the only supported value). The signature information is a set of key-value pairs separated by commas (,), with keys and values connected by equals signs (=). The following table describes each field in the signature information:
| Field | Required | Description |
|---|---|---|
Credential | Yes | Access key ID and scope, in the format <AccessKeyId>/<date>/<region>/oss/aliyun_v4_request. |
AdditionalHeaders | No | Additional signed headers included in the signature calculation. |
Signature | Yes | The computed HMAC-SHA256 signature value. Must not be blank. |
Examples
The following example shows an invalid request where the Signature field is present but empty:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,Signature=
x-oss-content-sha256: UNSIGNED-PAYLOADBoth required fields (Credential and Signature) are present, but Signature has no value.
Solutions
Make sure the Signature field contains the computed signature value before sending the request. The following example shows a valid request:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOADIf the server returns a response that includes the StringToSign parameter, compare the StringToSign value from the server against the string you computed before signing to identify any mismatch.
References
For information about how to use Alibaba Cloud SDKs to send V4-signed requests, see Overview.
For information about how to calculate the V4 signature, see Calculate V4 signature by using OSS SDK for Python.
For information about how to use the V1 signature instead, see Overview.