Problem description
The AdditionalHeaders field in the Authorization header contains an empty string. Object Storage Service (OSS) does not allow empty strings in V4-signed requests.
Causes
When constructing a V4 signature request, the AdditionalHeaders field in the Authorization header includes an empty header name. A trailing semicolon creates an implicit empty element.
Examples
In the following example, AdditionalHeaders=host; declares two elements: host and an empty string. OSS rejects the request because empty strings are not valid header names.
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host;,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOADSolutions
Option 1: Remove AdditionalHeaders
AdditionalHeaders is optional. If you do not need to include additional headers in the signature calculation, remove the field from the Authorization header entirely.
Option 2: Specify AdditionalHeaders correctly
If you include additional headers in the signature, follow these formatting rules:
| Rule | Detail | Example |
|---|---|---|
| Lowercase | All header names must be lowercase | host, range (not Host, Range) |
| Alphabetical order | Sort header names alphabetically | host;range (not range;host) |
| Semicolon-separated | Join header names with semicolons; no trailing semicolon | host;range (not host;range;) |
The following example shows a correctly formed request that includes Host and Range in the signature:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Range: 0-2560
Authorization: OSS4-HMAC-SHA256 Credential=AK**ID/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host;range,Signature=18**0a
x-oss-content-sha256: UNSIGNED-PAYLOADVerify the fix
If the server returns a StringToSign parameter in its error response, compare that value against the string your client constructed before signing. A mismatch indicates where the empty element was introduced.
References
Use Alibaba Cloud SDKs to construct V4-signed requests: Overview
Calculate the V4 signature manually: Calculate V4 signature by using OSS SDK for Python
V1 signature overview: Overview