Problem description
The AdditionalHeaders field in the Authorization header lists headers that do not exist in the actual request, or contains header names with underscores (_).
Causes
This error occurs when using the V4 signature. OSS validates that every header listed in AdditionalHeaders is present in the actual request. The error is triggered if either of the following conditions is true:
A header listed in
AdditionalHeadersis absent from the actual request.A header name listed in
AdditionalHeaderscontains an underscore (_).
Examples
The following request uses the V4 signature, but the AdditionalHeaders value is invalid:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host;range,Signature=n7****
x-oss-content-sha256: UNSIGNED-PAYLOADAdditionalHeaders=host;range declares that both the host and range headers are included in the signature. However, the range header is not present in the request, which causes the error.
Solutions
Choose one of the following fixes based on your situation.
Option 1: Remove the missing header from `AdditionalHeaders`
If you do not need to sign the range header, remove it from AdditionalHeaders:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Authorization: OSS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host,Signature=n7****
x-oss-content-sha256: UNSIGNED-PAYLOADOption 2: Add the missing header to the request
If you need to sign the range header, add it to the actual request:
GET /oss.jpg HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT
Range: 0-2560
Authorization: OSS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/oss/aliyun_v4_request,AdditionalHeaders=host;range,Signature=n7****
x-oss-content-sha256: UNSIGNED-PAYLOADOption 3: Remove header names that contain underscores
Header names with underscores (_) are not valid in AdditionalHeaders. Rename or remove those headers.
Verifying the fix with StringToSign
If the server returns a StringToSign value in the error response, compare it against the string you computed before signing. A mismatch confirms that the signed headers do not match the actual request headers.