0002-00000209

Problem description

The AdditionalHeaders field in the Authorization header of your V4-signed request is present but has no value.

Causes

When you construct a V4-signed request manually, the Authorization header must follow a specific format. The error occurs because AdditionalHeaders= appears in the header with a blank value, which is invalid.

The Authorization header has the following structure:

OSS4-HMAC-SHA256 <key>=<value>,<key>=<value>,...

Note: Only OSS4-HMAC-SHA256 is supported as the signature version identifier.

Examples

The following example shows an invalid request — AdditionalHeaders is present but blank:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOAD

Solutions

Choose one of the following options based on whether you need to include additional headers in the signature.

Option 1: Remove `AdditionalHeaders`

AdditionalHeaders is optional. If you are not including any extra request headers in the signature, remove the field entirely:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOAD

Option 2: Populate `AdditionalHeaders` correctly

If you need to include additional headers in the signature calculation, set AdditionalHeaders to a semicolon-separated list of those header names. Follow these rules:

• Use lowercase letters for all header names.

• Sort header names alphabetically.

• Separate multiple names with semicolons (;).

For example, to include the Host and Range headers, set AdditionalHeaders=host;range:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Range: 0-2560
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host;range,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOAD

Note: If the server returns a StringToSign value in the error response, compare it against the string you computed before signing to identify where the mismatch occurred.

References

• Use OSS SDKs to sign requests with V4

• Calculate V4 signatures — OSS SDK for Python source

• V1 signature overview