DocsICP FilingConsole
Documentation
Home Page Object Storage Service User Guide Support Error codes Error codes 02-AUTH 0002-00000225

0002-00000225

Updated at:
Copy as MD
Product
My Favorites

Problem description

The signature included in a request with IP address restrictions does not match the signature calculated by Object Storage Service (OSS).

Causes

You sent a request that uses a V4 signature and includes IP address restrictions. However, the signature in the request does not match the signature calculated by OSS.

Examples

You sent a URL-based request that uses a V4 signature. The request includes the x-oss-ac-subnet-mask field to specify IP address restrictions, but the signature is incorrect.

GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=***&x-oss-ac-subnet-mask=32&x-oss-additional-headers=host&x-oss-signature=InvalidSignature HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT

Solutions

  • If the request includes IP address restrictions, verify that the request originates from a specified IP address or CIDR block.

  • Use an SDK to send a request that uses a V4 signature. For more information, see Overview of sending requests using SDKs.

    If a signature mismatch error occurs after you send a request using an SDK, follow these steps to troubleshoot the issue.

    1. Check whether the endpoint is in the correct format.

      For the China (Hangzhou) region, the correct endpoint is http://oss-cn-hangzhou.aliyuncs.com. For more information about the endpoints of other regions, see Regions and endpoints.

    2. Check whether the AccessKey ID and AccessKey secret are valid.

      The AccessKey ID and AccessKey secret cannot start or end with spaces.

    3. Make sure that the bucket name and ObjectKey meet the naming conventions.

      • The naming conventions for bucket names are as follows:

        • Bucket names must be globally unique in OSS.

        • The name can contain only lowercase letters, digits, and hyphens (-).

        • The name must start and end with a lowercase letter or a digit.

        • The name must be 3 to 63 characters in length.

      • The naming conventions for object keys are as follows:

        • Use UTF-8 encoding.

        • The length must be from 1 to 1023 bytes.

        • The name cannot start with a forward slash (/) or a backslash (\).

        • The name is case-sensitive.

    4. Check the signature method.

      • If you calculate signatures yourself in an environment that supports SDKs, use the signature method provided by the OSS SDK. For more information, see Overview of initiating requests using SDKs.

      • If you calculate signatures yourself in an environment that does not support SDKs, you must write code to calculate signatures and add them to REST API requests. For more information, see Overview.

    5. Check whether additional headers are added to the proxy.

  • Implement a custom signing method.

    To implement V4 signing yourself, you can refer to the V4 signing implementation in the SDK. For more information, see Python SDK V4 signature implementation.

    When you implement a custom signing method, if the server returns the StringToSign string in the response, verify that the server-side string-to-sign matches the string that you used for signing.

Previous：0002-00000224Next：0002-00000226