0002-00000402

Problem description

The signature algorithm identifier in the Authorization header is invalid.

Causes

Your request uses an Amazon S3-compatible V4 signature, but the Authorization header specifies an unsupported algorithm identifier. OSS only accepts AWS4-HMAC-SHA256—no other algorithm identifiers are valid.

Examples

The following request fails because the Authorization header uses AWS4-HMAC-SHA1 instead of AWS4-HMAC-SHA256:

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization:AWS4-HMAC-SHA1 Credential=LTAI****************/20221220/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=34****
x-amz-content-sha256: abc****
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

Solutions

Use AWS4-HMAC-SHA256 as the algorithm identifier in the Authorization header:

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization:AWS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=34****
x-amz-content-sha256: abc****
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

To avoid constructing the Authorization header manually, use Amazon S3 SDKs to sign requests. For more information, see Use Amazon S3 SDKs to access OSS.