Problem description
The signature that includes IP address restrictions in the request does not match the signature calculated by Object Storage Service (OSS).
Causes
The request uses the V4 signature (OSS4-HMAC-SHA256) and includes the x-oss-ac-subnet-mask field to specify IP address restrictions. The signature in the request does not match the one OSS calculates.
Examples
The following request uses the V4 signature and includes the x-oss-ac-subnet-mask field for IP address restrictions. The signature is invalid.
GET /oss.jpg?x-oss-signature-verion=OSS4-HMAC-SHA256&x-oss-credential=***&x-oss-ac-subnet-mask=32&x-oss-additional-headers=host&x-oss-signature=InvalidSignature HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMTSolutions
If your environment supports Alibaba Cloud SDKs, use the SDK to generate signatures—manual calculation is not required. See Use Alibaba Cloud SDKs to initiate requests.
If you use the self-signed mode, calculate the V4 signature manually. Refer to the Python SDK implementation as a reference. After the server returns a response containing the StringToSign parameter, verify that the StringToSign value matches the string before calculation.
Troubleshoot SDK signature mismatches
If a signature mismatch occurs after using Alibaba Cloud SDKs, check the following items in order:
Verify the IP address restriction. If the request includes
x-oss-ac-subnet-mask, confirm that the request IP belongs to the specified IP addresses or CIDR blocks.Check the endpoint format. The endpoint must follow this format:
http://oss-<region-id>.aliyuncs.com. For example, the China (Hangzhou) endpoint ishttp://oss-cn-hangzhou.aliyuncs.com. For all region endpoints, see Regions and endpoints.Check the AccessKey ID and AccessKey secret. Neither the AccessKey ID nor the AccessKey secret can start or end with a space.
Check bucket and object names against naming conventions.
Bucket naming rules:
Lowercase letters, digits, and hyphens (-) only
Must start and end with a lowercase letter or digit
3–63 characters in length
Must be unique in OSS
Object naming rules:
UTF-8 encoded
1–1,023 bytes in length
Cannot start with a forward slash (/) or a backslash (\\)
Case-sensitive
Check the signature method.
If your environment supports OSS SDKs, use the SDK signature method. See Use Alibaba Cloud SDKs to initiate requests.
If your environment does not support OSS SDKs, write code to calculate signatures and include them in RESTful API requests. See Initiating RESTful API requests.
Check for extra headers added by a proxy server. A proxy may inject headers that alter the signed string, causing a mismatch.