Problem description
The x-oss-signature field in the V4 signed request is blank.
Causes
The request uses the V4 signature, but the x-oss-signature field is left blank. This typically happens when the signature calculation step is skipped or the computed value is not appended to the query string before sending the request.
Examples
The following example shows a request where x-oss-signature is blank:
GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=***&x-oss-expires=1141889120&x-oss-additional-headers=host&x-oss-signature= HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMTThe x-oss-signature field is required. It must contain the computed HMAC-SHA256 signature value.
Solutions
Include all required parameters in the query string, with x-oss-signature set to the computed signature value.
The following table lists the required and optional parameters for V4 signed URL authentication:
| Parameter | Required | Description | Example |
|---|---|---|---|
x-oss-signature-verion | Required | Signing algorithm version | OSS4-HMAC-SHA256 |
x-oss-credential | Required | Credential string in the format <AccessKeyId>/<date>/<region>/oss/aliyun_v4_request | LTAI5t****/20221220/cn-hangzhou/oss/aliyun_v4_request |
x-oss-expires | Required | URL validity period | 1141889120 |
x-oss-signature | Required | Computed HMAC-SHA256 signature value. Must not be blank. | 8u****a3 |
x-oss-additional-headers | Optional | Additional signed headers | host |
The following example shows a correct request with x-oss-signature populated:
GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=LTAI****************/20221220/cn-hangzhou/oss/aliyun_v4_request&x-oss-expires=1141889120&x-oss-additional-headers=host&x-oss-signature=8u**a3 HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMTNote: The***and**placeholders in the examples represent redacted credentials and signature values. Replace them with your actual AccessKeyId and computed signature before sending the request.
If the signature value is present but the server still returns an error, check the StringToSign value. If the server response includes StringToSign, compare it against the string you constructed before signing — they must match exactly.
References
For information about how to use Alibaba Cloud SDKs to initiate a request that uses the V4 signature, see Overview.
For information about how to calculate the V4 signature, see Calculate V4 signature by using OSS SDK for Python.
For information about how to specify the signature logic based on the V1 signature, see Overview.