0002-00000211

Problem description

The `AdditionalHeaders` field in the signature contains a header that is not included in the request.

Problem cause

The request uses a v4 signature. However, the `AdditionalHeaders` field in the `Authorization` request header contains a header that is not included in the request, or a header name contains an underscore (_).

Examples

Your request uses a V4 signature, but the Authorization request header contains incorrect AdditionalHeaders signature information:

GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host;range,Signature=n7****
x-oss-content-sha256: UNSIGNED-PAYLOAD

The value of the AdditionalHeaders field is host;range. This indicates that two additional request headers, `host` and `range`, are part of the signature. However, the `Range` request header is not included in the request.

Solutions

• Make sure that the AdditionalHeaders field does not contain a request header name with an underscore _.

• Remove `range` from the value of the AdditionalHeaders field.

  n7****GET /oss.jpg HTTP/1.1
  Host: oss-example.oss-cn-hangzhou.aliyuncs.com
  Date: Tue, 20 Dec 2022 08:48:18 GMT
  Authorization: OSS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host,Signature=n7****
  x-oss-content-sha256: UNSIGNED-PAYLOAD

• To keep the value of the AdditionalHeaders field as host;range, add the `Range` request header to the request.

  GET /oss.jpg HTTP/1.1
  Host: oss-example.oss-cn-hangzhou.aliyuncs.com
  Date: Tue, 20 Dec 2022 08:48:18 GMT
  Range: 0-2560
  Authorization: OSS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host;range,Signature=n7****

References

• For information about how to use Alibaba Cloud SDKs to initiate a request that uses the V4 signature, see Overview.

• Calculate the signature:

  • For information about how to calculate the V4 signature, see Calculate V4 signature by using OSS SDK for Python.

  • For information about how to specify the signature logic based on the V1 signature, see Overview.

  If the server returns a response that contains the StringToSign parameter, you must check whether the value of the StringToSign parameter on the server is the same as the string before calculation.