0002-00000408

Problem description

The Signature field in the Authorization request header is invalid.

Causes

The request used AWS Signature Version 4 (SigV4), but the Signature value in the Authorization header is incorrect. The Signature field must be 64 characters long. A value that does not meet this length requirement causes the error.

Examples

The following request fails because the Signature value is 1 — a single character that does not meet the 64-character length requirement:

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization:AWS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=1
x-amz-content-sha256: abc***
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

Solutions

Make sure the Authorization header is complete and the Signature value is correctly calculated. A valid request looks like this:

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization:AWS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=34****
x-amz-content-sha256: abc****
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

If the signature is still rejected, check the following:

• Signing algorithm: Confirm you are using AWS4-HMAC-SHA256 as the algorithm.

• Signed headers: Confirm all headers listed in SignedHeaders are included in the request and their values match exactly.

• Credential scope: Confirm the date, region, and service in the Credential field are correct (for example, 20221220/us-east-1/s3/aws4_request).

To avoid manual signature errors, use an Amazon S3 SDK to sign requests automatically. For setup instructions, see Use Amazon S3 SDKs to access OSS.