0002-00000405

Problem description

The SignedHeaders field is missing from the Authorization header of an Amazon S3-compatible V4 signature request sent to Object Storage Service (OSS).

Causes

The Authorization header for AWS Signature Version 4 (SigV4) requires three comma-separated fields: Credential, SignedHeaders, and Signature. The SignedHeaders field lists the request headers that were included in the signature calculation. Without it, OSS cannot verify which headers were signed and will reject the request.

The Authorization header has the following structure:

Examples

The following request is missing the SignedHeaders field:

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization: AWS4-HMAC-SHA256
  Credential=LTAI****************/20221220/us-east-1/s3/aws4_request,
  Signature=34****
x-amz-content-sha256: abc****
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

Line breaks in the Authorization header value are added for readability. The actual value must be a single line.

Solutions

Use an Amazon S3 SDK to sign requests automatically — the SDK constructs the correct Authorization header for you, including SignedHeaders. For setup instructions, see Use Amazon S3 SDKs to access OSS.

If you are constructing the Authorization header manually, make sure it includes all three fields — Credential, SignedHeaders, and Signature — in the correct order:

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization: AWS4-HMAC-SHA256
  Credential=LTAI****************/20221220/us-east-1/s3/aws4_request,
  SignedHeaders=host;x-amz-content-sha256;x-amz-date,
  Signature=34****
x-amz-content-sha256: abc****
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

The SignedHeaders value must exactly match the headers you included when computing the canonical request. In this example, the signed headers are host, x-amz-content-sha256, and x-amz-date.